Frequently Asked Question
Synology FTP, FTPS and SFTP setup and connection checks
QUICK ANSWER
Enable the required transfer service in DSM, grant the user access to the intended folder, then test from the local network. Use encrypted FTPS or SFTP for confidential files. A successful login with a failed folder listing often points to FTP data-connection settings rather than a wrong password.
Applies to: Synology DSM 7 and supported older DSM releases. Menu names differ; FTPS and SFTP are separate protocols.
Choose the right protocol
| Protocol | Connection and protection |
|---|---|
| FTP | Usually TCP 21 for control plus a separate data connection. Credentials and files are unencrypted. |
| FTPS | FTP with TLS. In a compatible client, select explicit FTP over TLS and match DSM’s configured port and passive range. |
| SFTP | SSH File Transfer Protocol, normally TCP 22 unless changed. It does not use FTP passive ports. |
Set up and test access
- Enable only the service you need. In DSM open Control Panel > File Services > FTP. Select FTPS or SFTP as appropriate and apply the settings. Record the actual configured port; it may differ from the default.
- Grant the intended permissions. In DSM 7, open Control Panel > User & Group, edit the user and check both shared-folder permissions and application/service privileges. Older DSM uses User. Test with a normal user account, not the default administrator.
- Connect on the LAN first. In a compatible client such as FileZilla, select the protocol explicitly, use the NAS’s local address and configured port, and sign in with that user’s NAS credentials. For SFTP select SFTP, not FTP with a changed port.
- Test an allowed operation. List the folder and transfer a small non-sensitive file. Read-only users should not be able to upload. If filenames display incorrectly, compare the client’s character encoding with DSM; UTF-8 is normally appropriate.
- Only then investigate remote access. Prefer your organisation’s approved VPN where suitable. If FTP/FTPS must be published, align the configured passive range, NAS firewall and router rules. Forward only the ports actually required by the selected service and setup, not the entire 1025–65535 range.
- Read the transfer log. A connection timeout, authentication rejection, denied folder and stalled directory listing are different faults. Record the last successful step and the exact client error before changing more settings.
Legacy DSM interface: this locates the FTP panel. Its unencrypted FTP selection is not a recommended setting for confidential transfers; select the encrypted service described above.
Anonymous access and key authentication
Leave anonymous FTP disabled for normal private sharing. DSM’s anonymous configuration uses a separate Anonymous FTP/WebDAV permission entry; it must never be given access to confidential folders. If you deliberately provide public downloads, restrict them to a separate read-only folder.
SFTP public-key login is an advanced, separate setup. Do not copy incomplete shell commands or apply broad home-folder permissions from an older guide. Confirm the current DSM procedure and retain another authorised way into the NAS before changing SSH keys.
Confirm the result
The approved user can list and transfer only the permitted files, the client shows the intended encrypted protocol, and access still works after reconnecting.
Before going further: Do not disable the firewall, publish SMB to the internet or enable anonymous write access to solve a login problem. Stop if the client reports an unexpected server identity or certificate.
If you need help
Include NAS model, DSM version, client version, selected protocol, configured port, LAN/remote test result and the exact error. Keep passwords and private keys out of the ticket. See how to prepare a Synology support request.
Updated 261108