groupadd ftpd
gpasswd -R ftpd
grpconv
useradd -g ftpd -s /bin/false -d /usr/share/empty
passwd -l ptpd
pwconv

Then edit vsftpd.conf to incude:

# It is recommended that you define on your system a unique user which the
# ftp server can use as a totally isolated and unprivileged user.
nopriv_user=ftpd

-----
About that SSL/TLS ; it's better if you have a cert from a CA but,
anyways here what worked for me:

mkdir -p /usr/share/ssl/certs
cd /usr/share/ssl/certs
openssl req -x509 -newkey rs:1024 -keyout vsftpd.pem -out vsftpd.pem \
  -days 365 -nodes
chmod 0400 *

And added the following to vsftpd.conf

### SSL/TLS:

# If enabled, and vsftpd was compiled against OpenSSL, vsftpd will support
# secure connections via SSL. This applies to the control connection
# (including login) and also data connections. You'll need  a client with
# SSL/TLS support too
ssl_enable=YES

# This option specifies the location  of the RSA certificate to use for SSL
# encrypted connections -  Default: /usr/share/ssl/certs/vsftpd.pem
#rsa_cert_file

# Only applies if ssl_enable is activated. If enabled, this option will permit
# SSLv2 protocol connections. TLSv1 connections are preferred
ssl_sslv2=YES

# Only applies if ssl_enable is activated. If enabled, this option will permit
# SSLv3 protocol connections. TLSv1  connections are preferred
ssl_sslv3=YES

# Only applies if ssl_enable is activated. If enabled, this option will permit
# TLSv1 protocol which is preferred
ssl_tlsv1=YES

# Only applies if ssl_enable is active. If set to YES, anonymous users will
# be allowed to use secured SSL connections
allow_anon_ssl=YES

# Only applies if ssl_enable is activated. If activated, all non-anonymous
# logins are forced to use a secure SSL connection in order to send the
# password
force_local_logins_ssl=YES

# Only applies if ssl_enable is activated. If activated, all non-anonymous
# logins are forced to use a secure SSL connection in order to send and
# receive data on data connections
force_local_data_ssl=NO