FileZilla Server is a free, open-source FTP and FTPS server for Windows, macOS and Debian Linux. It makes selected folders on a computer available to remote users, who connect with a compatible file transfer client. Administrators decide which folders each account can see, whether users can retrieve or change their contents, and how connections use the server’s resources.
Mount points
FileZilla Server presents shared storage through mount points. Each mount point connects an actual folder on the server to a virtual path that appears in the user’s client. A folder stored elsewhere on a disk can therefore appear at the user’s root directory or under a chosen folder name. Different accounts can have the same visible root path while being directed to separate physical folders.
Permissions determine what happens inside those paths. Read-only access allows users to retrieve files without changing them. Read-and-write access permits changes, while a separate directory setting controls whether users can create, rename or delete subfolders. Write-only access accepts files without allowing users to read or list the contents, making it suitable for an upload destination.
A disabled mount point can block a particular directory beneath an otherwise accessible path. Administrators can also decide whether a mount’s permissions extend to its subfolders. These settings remain subject to the underlying file system’s permissions: granting write access in FileZilla Server cannot make a file writable if the operating system denies it.
Account groups
Each user account has its own access state, credentials, mount points, address filters and limits. An account can belong to one or more groups, allowing administrators to assign common folder mappings and connection policies to several people. Groups can share a directory tree, for example, while individual users receive additional paths through their own account settings.
Groups also provide a shared scope for transfer limits. An administrator can restrict the combined transfer rate of a group instead of giving every member an independent allocation.
FTPS connections
The server’s listeners specify the IP addresses and ports that accept FTP connections. Each listener can require explicit FTP over TLS, or allow ordinary unencrypted FTP alongside it. FTPS encrypts the connection using TLS, with controls for the minimum accepted TLS version and the server certificate.
FileZilla Server can use an existing X.509 certificate and private key, generate a self-signed certificate, or generate a certificate through its integrated Let’s Encrypt support. The latter requires an account and validation of the server’s domain. Self-signed certificates are not trusted automatically by connecting clients.
SFTP and FileZilla Pro Enterprise Server
The free server supports FTP and FTPS. The separately sold FileZilla Pro Enterprise Server adds SFTP, Active Directory integration and two-factor authentication. SFTP uses SSH and is a separate protocol from FTP over TLS, so an SFTP client connection requires that edition.
Passive transfers
FTP uses separate connections for commands and file data. In passive mode, the client opens the data connection to an address and port supplied by the server. FileZilla Server can advertise a public IP address or hostname and restrict these data connections to a selected port range. It can use a local address for clients connecting from the same network.
The network configuration wizard helps select the passive port range and public address. Router forwarding and firewall rules must correspond to those settings for outside clients to reach the data connection.
Rate limits, address filters and Autoban
Upload and download rates can be limited separately. A limit can apply to each session or to the combined sessions belonging to a user. Choosing a shared limit prevents several simultaneous connections from multiplying that user’s allocation. Further controls limit concurrent sessions and the number of files or directories opened simultaneously.
Address filters accept individual IPv4 or IPv6 addresses and address ranges at the protocol, user or group level. Autoban adds a different control for failed logins: administrators choose a failure threshold, the delay before another attempt and the duration of an address ban.
FileZilla Server administration and logging
FileZilla Server has a separate administration connection with its own listener and TLS settings. Its interface shows active sessions, lets administrators inspect their details, and provides commands to terminate a session or ban its IP address.
Logging can record server activity at a chosen level of detail and send it to a file or the standard error output. File logs can rotate daily or when they reach a selected size, with a retention limit controlling how many remain.
