I have my VPS pretty much set up now, and want to upload some basic files to the server, which is running Ubuntu 9.10. I am using my home laptop with Windows XP and connecting to the VPS with PuTTY. How can I upload the files? Is there any ftp program, like in regular managed hostings, to just upload files with? I was thinking about ProFTPd, but don't have a clue how to get it to work.

4 Answers 4


I'd install sshd (openssh) on the Ubuntu system (secure shell server) and then use something like filezilla to transfer the files securely over scp, or anything that supports sftp or scp to transfer them up to the server. Plain FTP sends passwords in cleartext, a definitely bad thing to do.

I'd also consider installing sshd and modifying it to listen to a custom port other than 22 to ward off automated attack scans, and make sure you have a good password as well as installing a package like denyhosts to block multiple incorrect passwords (be careful not to lock yourself out, go through the config file and whitelist your own ip if you need to).

  • Moving to a non-standard port is still security through obscurity. Any port scanner will still catch it. If you want to restrict access, use packet filtering.
    – Warner
    May 26, 2010 at 16:56
  • 1
    It's not meant to stop people from finding that you're running it. It's meant to stop automated scans of SSH, and it's very effective against the largest portion of attacks out there as most of them are hardcoded to hit port 22. It's simply not efficient to hit every host and do a portscan for every port on every host an attacker wants to get. If someone wants to get your particular machine, no, it's not effective, and the denyhosts prevents brute force attacks, as I mentioned already in the answer. May 26, 2010 at 17:00
  • It's not a good idea no matter how many times it's suggested.
    – Warner
    May 26, 2010 at 17:03
  • @Warner: I moved it, my password attempts dropped to near nil. Once I had denyhosts in place, what few attempts I still had were reduced to nothing since it was pre-blocking IP's from other denyhost sites. I didn't put it in to make the system invulnerable, I put it there to reduce my attack surface, and the logs indicate it accomplished that. No more obscure than port knocking, it makes my system just less appetizing to script kiddies scanning for easy targets. May 26, 2010 at 17:18
  • And as I already acknowledged, it is security through obscurity, but it was only meant to reduce automated attacks from filling my logs and it was never meant as an effective means of keeping determined, targeted attacks from finding it. If you're being targeted for an attack you have another problem to deal with. May 26, 2010 at 17:20

Bart Silverstrim's answer is good, you really don't want to install a plain FTP server on your VPS.

His recommendation of WinSCP is the same I'd recommended. It's is primarily a scp/sftp client that added regular FTP/FTPS capabilities. Or, FileZilla which started as a FTP client, and later added scp, sftp & ftps capabilities. (Note: sftp == an FTP-like protocol tunneled over ssh, FTPS == Regular port 21 FTP + SSL/TLS (on another port), both protect from password sniffing)

Since you pointed out your already connecting with SSH, and by default, openssh installs with the sftp server enabled, you have everything you need on the server to transfer files to and from it with these 2 programs.


Putty comes with a secure FTP client called psftp.exe. It allows file transfers using the SSH protocol. You won't need an FTP server, the SSH server will do all the work.


You don't need any FTP. You have SSH access (I assume so, as you said you've configured it), that's enough. You can browse your server in e.g. nautilus, just type ssh://servername into the location bar. You can copy stuff with scp on the command line. You can even mount the filesystem on the server into your own using sshfs (there is a package on Debian/Ubuntu for it, named so). So why would you need an additional ftpd?

A note about SSH security: Best way is not to use passwords at all and authenticate with Public Keys, you also don't need the denyhosts stuff then.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy