Set Up vsftpd on Debian 13 for FTP Connections from MS-DOS 6.22

August 14, 2026

The built-in FTP.EXE client in MS-DOS 6.22 speaks plain FTP only. It does not support TLS, FTPS, or SFTP. Modern FTP servers often push encrypted connections by default, which makes them unusable from a retro MS-DOS machine on the same lab network.

This post walks through installing and configuring vsftpd on Debian 13 (Trixie) with encryption explicitly disabled, so files can be transferred to and from MS-DOS 6.22 using the stock FTP client. The same approach applies to other plain-FTP DOS clients, such as NCFTP.

Note: Plain FTP sends usernames and passwords in cleartext. Use this setup only on an isolated or trusted network for retro computing, not on the public Internet.

Install vsftpd

The vsftpd package is available in the default Debian 13 repository:

$ sudo apt update
$ sudo apt install vsftpd

After installation, the service is enabled but not yet configured for MS-DOS-friendly access.

Back up the default configuration

Before making changes, the original configuration file should be preserved:

$ sudo cp /etc/vsftpd.conf /etc/vsftpd.conf.bak

Configure plain FTP for MS-DOS clients

The main configuration file is /etc/vsftpd.conf. The shipped defaults listen on IPv6 and leave write access disabled. For MS-DOS clients on a local IPv4 network, a few options need to be set explicitly.

Open the file in an editor:

$ sudo vim /etc/vsftpd.conf

Ensure the following directives are present and uncommented:

listen=YES
listen_ipv6=NO

anonymous_enable=NO
local_enable=YES
write_enable=YES

local_umask=022

chroot_local_user=YES
allow_writeable_chroot=YES

ascii_upload_enable=YES
ascii_download_enable=YES

ssl_enable=NO

connect_from_port_20=YES
pasv_enable=YES
pasv_min_port=40000
pasv_max_port=40100

A brief explanation of the important settings:

listen=YES and listen_ipv6=NO — bind to IPv4 only. Many DOS TCP/IP stacks do not handle IPv6.
ssl_enable=NO — keep the control and data channels unencrypted so FTP.EXE can connect.
write_enable=YES — allow uploads from authenticated users.
chroot_local_user=YES — restrict each user to their home directory.
ascii_upload_enable and ascii_download_enable — let the server honour ASCII mode for text files, which DOS clients use for .TXT, .BAT, and similar files.
connect_from_port_20=YES — support active mode. The MS-DOS 6.22 client uses active mode by default.
pasv_enable=YES with a fixed port range — support passive mode for clients or third-party DOS FTP programs that request it.

Create a dedicated FTP user

Using a dedicated account instead of a regular login keeps the FTP home directory separate from system files. The example below creates a user dosftp with home directory /srv/ftp/dos:

$ sudo mkdir -p /srv/ftp/dos
$ sudo useradd -d /srv/ftp/dos -s /usr/sbin/nologin dosftp
$ sudo chown dosftp:dosftp /srv/ftp/dos
$ sudo passwd dosftp

A password needs to be entered when prompted. Keep it short and simple — some DOS FTP clients mishandle special characters or long passwords.

Open firewall ports

If a firewall is active, FTP control and data ports must be allowed. With nftables, the rules depend on the existing configuration. With ufw, the following commands cover both active and passive modes:

$ sudo ufw allow 21/tcp
$ sudo ufw allow 20/tcp
$ sudo ufw allow 40000:40100/tcp

Port 21 is the FTP control channel. Port 20 is used for active-mode data connections initiated by the server. Ports 40000–40100 are used for passive-mode transfers.

Start and verify the service

After saving /etc/vsftpd.conf, vsftpd needs to be restarted:

$ sudo systemctl restart vsftpd
$ sudo systemctl enable vsftpd

The service status can be checked:

$ sudo systemctl status vsftpd

The output should show active (running).

A quick test from another Linux machine on the same network confirms that plain FTP works before trying MS-DOS:

$ ftp -n 192.168.1.100
ftp> user dosftp
331 Please specify the password.
Password:
230 Login successful.
ftp> ls
229 Entering Extended Passive Mode (|||40001|)
150 Here comes the directory listing.
226 Directory send OK.
ftp> bye
221 Goodbye.

Replace 192.168.1.100 with the actual IP address of the Debian server.

Connect from MS-DOS 6.22

On the MS-DOS machine, FTP.EXE is started from the command prompt. The server IP address, username, and password from the previous steps are used:

C:\> ftp 192.168.1.100
Connected to 192.168.1.100.
220 (vsFTPd 3.0.5)
User (192.168.1.100:(none)): dosftp
331 Please specify the password.
Password:

230 Login successful.
ftp> dir
200 PORT command successful. Consider using PASV.
150 Here comes the directory listing.
226 Directory send OK.
ftp> ascii
200 Switching to ASCII mode.
ftp> get readme.txt
200 PORT command successful. Consider using PASV.
150 Opening ASCII mode data connection for readme.txt.
226 Transfer complete.
ftp> binary
200 Switching to Binary mode.
ftp> get pkzip.exe
200 PORT command successful. Consider using PASV.
150 Opening BINARY mode data connection for pkzip.exe.
226 Transfer complete.
ftp> put myfile.txt
200 PORT command successful. Consider using PASV.
150 Ok to send data.
226 Transfer complete.
ftp> bye
221 Goodbye.

Use ascii before transferring text files and binary before transferring executables or archives. The dir command lists remote files; lcd changes the local MS-DOS directory before a get or put.

If the MS-DOS machine sits behind NAT and active mode fails with a timeout, a third-party DOS FTP client with passive mode support (for example NCFTP) can be used instead of the built-in FTP.EXE. The passive port range configured earlier must remain open on the server firewall.

Summary

In this post, vsftpd was installed on Debian 13 and configured for unencrypted FTP with both active and passive mode support. A dedicated user was created, firewall ports were opened, and the setup was verified from Linux and MS-DOS 6.22. This provides a practical way to move files between a modern Debian server and a vintage MS-DOS workstation on a trusted local network.

Tags: