Next: , Previous: , Up: GNU Inetutils   [Contents][Index]


21 ftpd: FTP daemon

ftpd is the Internet File Transfer Protocol server process. The server uses the TCP protocol and listens at the port specified in the ‘ftp’ service specification.

ftpd [option]…
-4
--ipv4

Daemon uses only IPv4 addressing. Ignored in inetd mode.

-6
--ipv6

Daemon uses only IPv6 addressing. Ignored in inetd mode.

-A
--anonymous-only

Only anonymous login is allowed.

-a auth
--auth=auth

Specify what authentication mechanism to use for incoming connections. Possible values are: ‘kerberos’, ‘kerberos5’, ‘opie’, ‘pam’, and ‘default’.

Anonymous logins will continue to work when this option is used, unless the user ‘ftp’ is removed from the system.

-D
--daemon

ftpd enters daemon-mode. That allows ftpd to be run without inetd.

-d
--debug

Debugging information is written to the syslog using facility ‘LOG_FTP’.

-l
--logging

Each successful and failed ftp session is logged using syslog with a facility of ‘LOG_FTP’. If this option is specified twice, the retrieve (get), store (put), append, delete, make directory, remove directory and rename operations and their filename arguments are also logged.

--non-rfc2577

Do not follow the suggestion of RFC 2577 to suppress messages that could help an attacker to conduct user name enumeration. This option allows the server to return with an error message immediately upon receipt of a user name. Such information includes non-existence claims and expiration claims. The ideal mode would otherwise be to fake the relevance of asking for a password, and only thereafter report an invalid login.

-p pidfile
--pidfile=pidfile

Change default location of pidfile.

-q
--no-version

Quiet mode. No information about the version of the ftpd is given to the client.

-T
--max-timeout

A client may also request a different timeout period; the maximum period allowed may be set to timeout seconds with the -T option. The default limit is 2 hours.

-t timeout
--timeout=timeout

The inactivity timeout period is set to timeout seconds (the default is 15 minutes).

-u umask
--umask=umask

Set default umask, expressed in base 8.

The file /etc/nologin can be used to disable FTP access. If the file exists, ftpd displays it and exits. If the file /etc/ftpwelcome exists, ftpd prints it before issuing the ‘ready’ message. If the file /etc/motd exists, ftpd prints it after a successful login.

If this server was compiled with PAM support, then any non-anonymous connection request will also be checked for settings pertaining to the PAM service ‘ftp’, before finally being accepted.

Linux-PAM is particular in that it also provides a module ‘pam_ftp.so’ influencing even anonymous access. By convention the present server relies on the functionality in that module when built on relevant systems. However, the module is known to be partially broken since ten years back, when one compares the claims in its manual page, so not all claimed trickery is available!

21.1 Standards

The FTP server currently supports the following FTP requests. The letter case of any request is ignored.

RequestDescription
ABORabort previous command
ACCTspecify account (ignored)
ALLOallocate storage (vacuously)
APPEappend to a file
CDUPchange to parent of current working directory
CWDchange working directory
DELEdelete a file
EPSVextended passive transfer request
EPRTspecify data connection port
HELPgive help information
LISTgive list files in a directory (“ls -lgA”)
LPRTspecify data connection port
LPSVlong passive transfer request
MKDmake a directory
MDTMshow last modification time of file
MODEspecify data transfer mode
NLSTgive name list of files in directory
NOOPdo nothing
PASSspecify password
PASVprepare for server-to-server transfer
PORTspecify data connection port
PWDprint the current working directory
QUITterminate session
RESTrestart incomplete transfer
RETRretrieve a file
RMDremove a directory
RNFRspecify rename-from file name
RNTOspecify rename-to file name
SITEnon-standard commands
SIZEreturn size of file
STATreturn status of server
STORstore a file
STOUstore a file with a unique name
STRUspecify data transfer structure
SYSTshow operating system type of server system
TYPEspecify data transfer type
USERspecify user name
XCUPchange to parent of current working directory (deprecated)
XCWDchange working directory (deprecated)
XMKDmake a directory (deprecated)
XPWDprint the current working directory (deprecated)
XRMDremove a directory (deprecated)

The following non-standard, or UNIX specific, commands are supported by the SITE request.

RequestDescription
UMASKchange umask, e.g. SITE UMASK 002
IDLEset idle-timer, e.g. SITE IDLE 60
CHMODchange mode of a file, e.g. SITE CHMOD0 0CHMOD1 1CHMOD2
HELPgive help information.

The remaining FTP requests specified in RFC 959 are recognized, but not implemented. The extensions MDTM, REST, and SIZE are specified in RFC 3659, while EPRT and EPSV appear in RFC 2428, LPRT and LPSV in RFC 1639.

The ftp server will abort an active file transfer only when the ABOR command is preceded by a Telnet ‘Interrupt Process’ (IP) signal and a Telnet ‘Synch’ signal in the command Telnet stream, as described in Internet RFC 959. If a STAT command is received during a data transfer, preceded by a Telnet IP and Synch, transfer status will be returned.

ftpd interprets file names according to the globbing conventions used by csh. This allows users to utilize the metacharacters ‘*?[]{}~’.

The server applies the suggestions in RFC 2577, but the legacy behaviour with informational content in denials can be restored using the option --non-rfc2577.

21.2 Authentication

ftpd authenticates users according to four rules.

  1. The login name must be in the password data base, /etc/passwd, and must not have a null password. In this case a password must be provided by the client before any file operations can be performed.
  2. The login name must not appear in the file /etc/ftpusers.
  3. The user must have a standard shell.
  4. If the user name is ‘anonymous’ or ‘ftp’, an anonymous ftp account must be present in the password file (user ‘ftp’). In this case the user is allowed to log in by specifying any password (by convention an email address for the user should be used as the password).

A further access mechanism is provided by the file /etc/ftpchroot. A user mentioned therein will have all access confined to the subtree rooted at the home directory specified in /etc/passwd.

In the case of anonymous access, ftpd takes special measures to restrict the client’s access privileges. The server always performs a chroot to the home directory of the ‘ftp’ user.

In order that system security is not breached, it is recommended that the ‘ftp’ subtree be constructed with care, following these rules:

~ftp

Make the home directory owned by ‘root’ and not writable by anyone.

~ftp/bin

Make this directory owned by ‘root’ and not writable by anyone (mode 555). The program ls must be present to support the list command, unless the server was compiled with libls support. This program should be mode 111.

~ftp/etc

Make this directory owned by ‘root’ and not writable by anyone (mode 555). The files passwd and group must be present for the ls command to be able to produce owner names rather than numbers. The password field in passwd is not used, and should not contain real passwords. The file motd, if present, will be printed after a successful login. These files should be mode 444.

~ftp/pub

Make this directory mode 777 and owned by ‘ftp’. Guests can then place files which are to be accessible via the anonymous account in this directory.

21.3 Configuration files

/etc/ftpchroot

List of users to enclose in a chrooted directory. The anonymous user ‘ftp’ is always considered to be a member of this list, explicit or not.

/etc/ftpusers

List of unwelcome/restricted users, always to be denied access.

/etc/ftpwelcome

Welcome notice printed before server identification and any authentication exchange.

/etc/motd

Welcome notice presented after completed login.

/etc/nologin

If present, the contents are displayed and all further access is refused.

21.4 File format of ftpusers and ftpchroot.

The files /etc/ftpusers and /etc/ftpchroot share a common file format. For better conformity with other implementations, each line is understood as consisting of fields separated by spaces, or by horizontal tabulators. Only the first non-empty field is examined at present. Both files are used for matching against a user name, desiring to use the FTP service.

Whenever the first printable character is a hash ‘#’, the input line is taken as a comment, and is ignored. Lines lacking non-empty fields are likewise ignored.

A field consisting of a single at-sign ‘@’, is treated as a wildcard and matches every input.

A field commencing with an at-sign ‘@’ and then continuing with an identifier, is understood as giving the name of a group. Should this name exist in /etc/groups, and the user name be a member of this same group, then the user name matches.

In all other cases, the field is taken as the identifier of a user, with which the requesting user is compared for verbatim match.

It is worthwhile to observe from the above cases, that a single ‘@’ on a line by itself in /etc/ftpchroot, will enforce chrooting upon every user allowed to access the FTP service. This gives a Draconian, protective configuration.


Next: rexecd: server for rexec, Previous: syslogd: system service logging faclity, Up: GNU Inetutils   [Contents][Index]