Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How do i configure proftpd to only listen to connections on If i set

DefaultAddress localhost

in /etc/proftpd/proftpd.conf

and restart proftp i'm still able to login from another computer...

is this the wrong option? Or ist this just a stupid use case and no one but me would ever need such functionalty?!?

share|improve this question
up vote 0 down vote accepted

Did you try using instead of localhost. Maybe /etc/hosts has something strange in there.

Failing that, the ProFTPd FAQ suggests using the Allow and Deny options, or run it from xinetd, or enable the tcp wrappers module and set that up.

Or of course you could use iptables.

share|improve this answer
using iptables was quick and easy :-) – bla Jan 19 '11 at 13:03

It doesn't look like there's an option inside the configuration file. This is one way to do it, which will also allow you to filter by username (using PAM):

Create a file called /etc/security/proftpd.conf containing the following lines:

+ : ALL :  
+ : ALL : localhost  
- : ALL : ALL

The + means allow, the second column is the username, and the third column is the hostname of the incoming connecion. So, for example, + : john : will allow john to connect from A - denies them.

Next, modify /etc/pam.d/proftpd to add the following somewhere near the top (I make it the first line after session) to make it read the new file:

auth       required accessfile=/etc/security/proftpd.conf

It should take effect immediately without the need for a service restart.

share|improve this answer
On Ubuntu 12.04, I had to also enable PAM authentication by uncommenting the line # AuthOrder mod_auth_pam.c* mod_auth_unix.c in /etc/proftpd/proftpd.conf. – Ivan Vučica Oct 17 '13 at 13:13

To get proftpd to listen only on localhost, you would use both DefaultAddress and SocketBindTight, like so:

DefaultAddress localhost
SocketBindTight on

By default, proftpd will listen on all interfaces for a given port (e.g. "*:21"). The SocketBindTight directive tells proftpd to bind "tightly" to the address/socket, rather than using a wildcard socket (resulting in e.g. "").

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.