I'm trying to tweak vsftpd to achieve maximum performance for my usage:

  • I have only one or two clients that connect to the server.
  • File size is between ~15MB and 1GB.
  • Typical transfer batch represent between 1 and 2GB of data.

For testing purposes, I'm using a tmpfs on both sides (thus eliminating any disks bottleneck) with a single 1GB file.

When SSL is disabled, performance is good, with a transfer rate at ~120MB/s (reaching the limits of gigabit networking).

With SSL enabled only for control traffic (and not data traffic), performance drops at about 112MB/s, which is still within the acceptable limits.

However, when SSL is enabled for data flows, the transfer speed drops dramatically:

  • 6.7MB/s using 3DES & SHA (ssl_ciphers=DES-CBC3-SHA in vsftpd.conf)
  • 16MB/s using DES & SHA (ssl_ciphers=DES-CBC-SHA)

I didn't tested other ciphers, but from what I can see from the CPU usage during the transfer, it seems that vsftpd is only using a single cpu/core per client. While this can fit for large ftp sites with hundreds of clients, I'd like to avoid this behavior and use more ressources on the server.

On a side note, if you have any ideas regarding other openssl ciphers...

  • Try the RC4-MD5 cipher. Seems to be a good balance of performance & security.
    – HTTP500
    May 2 '12 at 14:28
  • @HTTP500: indeed, way much better. 75MB/s average, albeit still using only 1 core.
    – petrus
    May 2 '12 at 17:21

I just read http://unhandledexpression.com/2013/01/25/5-easy-tips-to-accelerate-ssl/ which suggests to run openssl speed. Depending on the results, you might want to pick another algorithm. Sadly, I have no idea how to spread the load of one encryption task to several cores.

  • Indeed. I'm using RC4-MD5, but still looking for the solution.
    – petrus
    Jan 29 '13 at 21:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.