Can I configure VSFTPD to listen only to localhost?

Question

I have a legacy app that needs FTP and cannot do SFTP.

My solution is:

• put an FTP server in place using VSFTPD
• configure the firewall to accept port 21 connections only from localhost
• Set up an SSH connection from the client with the legacy app
• Tunnel the FTP through SSH

I'm wondering though if I can configure VSFTPD to ignore connections from anywhere but localhost on its own, in addition to the firewall. Belt and bracers both.

Answer 1

Yes. Configure the vsftp server to listen only on 127.0.0.1: this can be done in the vsftp.conf file:

listen_address 127.0.0.1

To use this parameter, the server needs to be in standalone mode:

listen yes

If you want to use IPv6, use these entries instead:

listen_ipv6 yes
listen_address6 ::1

This is the same as the first, but uses IPv6.

You'll almost certainly have to restart to make this work.