Install Cerberus FTP Server on Windows Secure Setup Guide

Cerberus FTP Server is a commercial Windows file transfer server. It is polished, fast to install and built for offices that need FTP, FTPS, SFTP and HTTPS in one program. It is not free software. There is a trial, covered honestly on the trial page in this series, and after the trial a paid licence is needed to keep using it properly. Decide that first, so you do not build a production system on a trial clock.

1. Use a Windows PC or Windows Server with a fixed local IP address, for example 192.168.1.100. A changing DHCP address breaks clients and firewall rules silently.
2. Create the file root folder first, for example D:\CerberusFiles, ideally on a data drive and not inside the Windows folder.
3. Decide who connects and how - on the office LAN only, or from outside as well. That one decision controls almost every security step below.
4. Download the installer only from the official Cerberus website. Never use a cracked build of a file server - it holds your files and your passwords.

The install itself really is quick, which is why the video title says 5 minutes. Run the installer as administrator, accept the defaults, and Cerberus opens its Server Manager with a Getting Started wizard.

1. In the wizard, set the server name and confirm the listeners you need. For a first test, FTP on port 21 is enough on your own LAN.
2. Let the wizard create or select a certificate if it offers one. You can replace it later - the certificate page in this series explains self signed versus real certificates honestly.
3. Choose to run Cerberus as a Windows service if this PC must serve files after you log off. A server that stops when you sign out is not a server.
4. Click Setup Server to finish the wizard. The server is now ready for local network connections.

That is the end of the fast part. Everything after this point is what turns a 5 minute install into a server you can actually trust.

Never share one common login with the whole office, and never enable anonymous write access. Cerberus has its own user system in Server Manager, separate from Windows accounts unless you connect Active Directory on supported editions.

1. Open User Manager and create one account per person, with a strong unique password for each person.
2. Set each user home folder or virtual folders to only the folders that person needs. A delivery user does not need the accounts folder.
3. Set permissions per folder - download only, upload only, or both - instead of giving everyone full control everywhere.
4. Turn on password policy and automatic account lockout if your edition offers them, so repeated wrong passwords lock the account instead of inviting guessing all night.

The user accounts page in this series goes deeper on groups, virtual directories and what to do when someone leaves.

Plain FTP sends the username, the password and every file in clear readable text. Anyone who can watch the traffic can copy all three. That is acceptable only inside a trusted LAN for a short test - it is never acceptable across the internet.

1. For FTPS, use the FTPS listener on port 990 for implicit TLS, or require TLS on the port 21 listener for explicit FTPS. In the user or listener settings, require a secure connection so plain logins are refused.
2. For SFTP, enable the SSH SFTP listener on port 22. SFTP is a different protocol from FTP despite the similar name - it runs over SSH and encrypts everything, and it needs only that one port.
3. Test with FileZilla or WinSCP and confirm the connection is actually encrypted. In FileZilla, FTPS shows a lock and a certificate prompt the first time.
4. Tell users plainly which protocol to use. If you leave plain FTP open next to FTPS, people will keep using the insecure one.

The FTPS and SFTP page in this series covers the per user require secure setting and the common client mistakes in full.

An FTP login uses the control port, but listings and files travel on separate data ports that the server picks from its passive range. Cerberus default passive range is 11000-13000, shown on the Protocols settings in Server Manager. You may narrow it, but keep at least a few hundred ports - each listing or transfer uses a port and ports cannot be reused for several minutes.

1. Note the passive range in Cerberus first. Whatever range you choose there is the range every other step must match exactly.
2. In Windows Defender Firewall, allow the Cerberus program or create inbound rules for your control ports - 21, 22, 990 or 443, only the ones you use - plus the full passive range.
3. Scope firewall rules to your LAN subnet for LAN only servers. Do not open ports to Any if the server never serves the internet.
4. If outside access is needed, forward the same ports on the router to the server fixed IP. The passive ports page in this series walks through server, firewall and router as one chain.