Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to tweak vsftpd to achieve maximum performance for my usage:

  • I have only one or two clients that connect to the server.
  • File size is between ~15MB and 1GB.
  • Typical transfer batch represent between 1 and 2GB of data.

For testing purposes, I'm using a tmpfs on both sides (thus eliminating any disks bottleneck) with a single 1GB file.

When SSL is disabled, performance is good, with a transfer rate at ~120MB/s (reaching the limits of gigabit networking).

With SSL enabled only for control traffic (and not data traffic), performance drops at about 112MB/s, which is still within the acceptable limits.

However, when SSL is enabled for data flows, the transfer speed drops dramatically:

  • 6.7MB/s using 3DES & SHA (ssl_ciphers=DES-CBC3-SHA in vsftpd.conf)
  • 16MB/s using DES & SHA (ssl_ciphers=DES-CBC-SHA)

I didn't tested other ciphers, but from what I can see from the CPU usage during the transfer, it seems that vsftpd is only using a single cpu/core per client. While this can fit for large ftp sites with hundreds of clients, I'd like to avoid this behavior and use more ressources on the server.

On a side note, if you have any ideas regarding other openssl ciphers...

share|improve this question
Try the RC4-MD5 cipher. Seems to be a good balance of performance & security. – HTTP500 May 2 '12 at 14:28
@HTTP500: indeed, way much better. 75MB/s average, albeit still using only 1 core. – petrus May 2 '12 at 17:21

I just read which suggests to run openssl speed. Depending on the results, you might want to pick another algorithm. Sadly, I have no idea how to spread the load of one encryption task to several cores.

share|improve this answer
Indeed. I'm using RC4-MD5, but still looking for the solution. – petrus Jan 29 '13 at 21:45

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.