After attempting to configure pureftp, I gave up. The configuration is ridiculous and even after hours of monkeying I could not get it to behave as I wanted.
Then I tried vsftpd. After 20 minutes, the server is up and running just the way I want it. From what I can tell (no debian security advisories in the recent past) vsftpd lives up to its name, very secure.