PremiumComes with the add-on reqad-pureftpd. Installing add-ons

FTP server

The FTP server add-on installs and manages Pure-FTPd. Logins are always encrypted (FTP over TLS is required), hosting accounts can log in with their own password, and you can give extra FTP users access to a single folder of an account.

Premium add-on. Package reqad-pureftpd, see installing an add-on. It adds FTP Server to the menu and an FTP tile on the dashboard. Pure-FTPd itself comes from EPEL and is installed with it.

What the first install does

Writes the settings the add-on manages into /etc/pure-ftpd/pure-ftpd.conf: TLS required, passive ports 10000-65535, a limit on directory listings, and the certificate file.
Copies the server hostname's certificate (the one the panel uses) to /etc/pki/pure-ftpd/pure-ftpd.pem. A certbot hook copies it again and restarts Pure-FTPd whenever it is renewed. Sync certificate on the page does the same by hand.
Opens port 21 and the passive range in the firewall.
Turns on PAM authentication (hosting accounts), leaves PureDB virtual users off, then enables and starts the service.

Updates of the add-on never rewrite your configuration. If pure-ftpd.conf no longer has the managed settings, because it was edited by hand or by another package, the page says so and offers Re-apply. If the firewall does not allow port 21 and the passive range, the page says that too.

Two kinds of login

	PAM authentication	PureDB virtual users
Who	Hosting accounts, with their system user name and password (the one SSH uses, set in Accounts > Manage).	Extra FTP-only logins named `name@domain`, each belonging to one hosting account.
Where they land	The account's home folder.	One folder of the account, which they cannot leave. Empty = the whole home folder.
Files they upload	Belong to the hosting account, as if it had uploaded them.

Turn each one on or off under Authentication. At least one must stay on. Turning PureDB off keeps its users, who just cannot log in until you turn it on again.

Prefer SFTP with a key. FTP over TLS is encrypted, but FTP programs usually save the password on the user's computer, where malware steals it. Where you can, use SFTP with an SSH key instead. Where FTP is needed, prefer PureDB users locked to one folder over the account's own password.

FTP users

With PureDB on, the PureDB virtual users card lists the FTP users and adds new ones: choose the hosting account, a name (lowercase letters, digits, dot, dash, underscore) and a folder. The login becomes name@<the account's domain>. The folder is made, as the account, if it does not exist. Change password and Delete are on each row; deleting a user keeps the files in its folder.

With the account panel, accounts manage their own FTP users under Files > FTP accounts, and programs can do it through the API (GET /v1/ftp, POST/PATCH/DELETE /v1/ftp/users). Both need PureDB turned on here.

Connecting

In FileZilla, WinSCP or Cyberduck, choose FTP with explicit TLS (not SFTP), the server's hostname, port 21, and the full login, including the part after @ for an FTP user. The Recent log card shows the last 200 lines of journalctl -u pure-ftpd, for a login that does not work.

Need a hand? Create a free account or contact us.