Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm aware of the following:

  • I can disable access to port 21 via the firewall
  • I can disable access to non-ssl connections to users in the admin interface of FileZilla
  • I can restrict access to the server by IP via the firewall

all of which I've done already.

However, is it possible to completely switch off port 21? I only want to enable FTP over SSL and not standard FTP on port 21 regardless of the above points.

share|improve this question
up vote 1 down vote accepted

I ran into the exact same requirement, and it turns out to be really easy. Under Settings > General settings of the Admin Interface, simply empty the "Listen on these ports:". Additionally go to "FTP over TLS settings" and uncheck "Allow explicit FTP over TLS" since that won't work without anyway.

After hitting Ok, it'll say the following in the log: "Creating listen socket on port 990..." or whatever port you set for implicit FTP. Whereas before this change, it would list both :)

share|improve this answer

Check the box for "Disallow plain unencrypted FTP", that will do exactly what you are looking for.

enter image description here

Now if a user connects on port 21 they are required to use "explicit FTP over TLS" and non encrypted connections will be rejected.

share|improve this answer
But I want to turn off port 21 - not force them to do anything else, but not actually be able to connect in the first place. – Leonard Challis Jun 13 '13 at 22:42
So you want them to only allow implicit SSL/TLS connections? (only can connect on 990?) I am not understanding what you are trying to do. I have a feeling you are having a XY problem, can you explain why you are trying to "turn off" port 21? Not allowing ftp on port 21 and not allowing unencrypted SSL connections are two separate issues. You can still have port 21 open but have it not work for unencrpyted connections, which is kind of "turning it off", you need to explain more what you are trying to accomplish. – Scott Chamberlain Jun 14 '13 at 4:10
Because we don't want any more ports open than is needed, less ports to scan and less entry points for attacks, less reliance on X software not having an exploit on port 21. We were using freeFTPd which simply allowed us to turn on 990 or 21 as we wished which is exactly what I want, but it's flakey and the service kept failing. – Leonard Challis Jun 14 '13 at 6:06
Then I would reword your question to (or add to it) "How to I make FileZilla Server allow only implicit SSL/TLS connections?". However I think the answer to that is, "you can disable all non TLS connections but you can't have only implicit TLS connections, filezilla requires you to have a port open for explicit TLS connections (by default port 21) but you can change that port to a non standard port" – Scott Chamberlain Jun 14 '13 at 6:10
My question is "How do I disable port 21" - wihch is exactly what I want. I want to disable port 21. But thanks for that answer I will mark it as correct as I think this is as close as we get. – Leonard Challis Jun 14 '13 at 7:08

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.