ftpd

DARPA internet file transfer protocol daemon (UNIX)

Syntax:

ftpd [-AdHklru] [-a anondir] [-c confdir] 
     [-h hostname] [-V version]

Options:

-A

Allow clients to access non-regular files such as named special files under /dev/shmem. Use this option only when access to such files are necessary -- this may allow mallicious users to open any path on the system (for which they have appropriate file permissions) with undesired results.

-a anondir

Use this as the root directory ( chroot()) for anonymous logins. By default, the home directory of the ftp user is used.

-c confdir

Change the root directory of the configuration files from /etc to confdir.

-d

Write debugging info to the system log using LOG_FTP. In order to capture the log messages, you need to have syslogd running.

-H

Set the system's hostname (see gethostname()) as the hostname to advertise.

-h hostname

Set this hostname to advertise as the hostname. By default, the hostname associated with the IP address that ftpd listens on is used. The ability to advertise a hostname (either explicitly with -h, or implicitly by default), and change the root directory of a configuration file (see -c confdir) allows you to configure "virtual" FTP servers that can listen in on separate addresses as separate names. For more information about starting services to listen in on specific IP interfaces, see /etc/inetd.conf.

-k

Disable the keepalive (SO_KEEPALIVE) option on the ftpd sockets. By default, keepalive is on and messages are sent out on the data connection at least every two hours. If the client fails to respond, the connection is considered broken and is closed. The -k option disables this.

---

The current npm-ttcpip.so doesn't support keepalive.

---

-l

Log each ftp session in the system log using LOG_FTP. If this option is specified twice, then include the retrieve (get), store (put), append, delete, make directory, remove directory and rename operations and their filename arguments in the log.

-r

Permanently drop root privileges when the user logs in. This may result in the server using a port other than the (listening-port - 1) for PORT style commands, which is contrary to the RFC 959 specification (in practice, few clients rely upon this behaviour). See Security considerations below for more details.

-u

Log concurrent FTP sessions to /var/run/utmp, to make them visible for other commands.

-V version

Advertise this version in the login banner and in the output of STAT and SYST instead of the default version information. Don't display any version information if the value of version is empty or "-".

Description:

The ftpd daemon is a DARPA Internet File Transfer Protocol server. It uses the TCP protocol.

The ftpd daemon is started when inetd receives a service request at the port specified by the FTP entry in the /etc/services file (inetd listens for service requests specified in the /etc/inetd.conf file at a port defined in the services file).

Since stdin and stdout must be TCP sockets, you should launch the ftpd daemon from the inetd daemon or from a similar application. It can't be started on the command line.

Displaying welcome messages

The ftpd daemon checks for the existence of the following files. If a file exists, the appropriate action is performed.

Supported ftp requests

The ftpd daemon currently supports the following ftp requests; case isn't distinguished.

The following FTP requests (as specified in RFC 959) are recognized, but aren't implemented: ACCT, REIN, and SMNT. The MDTM and SIZE requests aren't specified in RFC 959, but will appear in the next RFC update.

ABOR command

The ftp daemon aborts an active file transfer only when the ABOR command is preceded by a Telnet "Interrupt Process" (IP) signal and by a Telnet "Synch" signal in the command Telnet stream, as described in Internet RFC 959. If a STAT command is received during a data transfer and is preceded by a Telnet IP and Synch, transfer status is returned.

SITE nonstandard commands

The following nonstandard or UNIX-specific commands are supported by the SITE request:

Metacharacters

Because the ftpd daemon interprets filenames according to the globbing conventions used by sh, users can employ these metacharacters:

*  ?  [  ]  ~

User authorization

The ftpd daemon authenticates users according to these rules:

1. The username must be in the password database /etc/passwd and must not have a null password. The client must provide a password before any file operations may be performed.
2. The username must not appear in the /etc/ftpusers file, which contains a list of users who aren't allowed to use ftp. One username is listed per line. If this file is missing, no user on the local system may access ftp.
3. The user must have a standard shell (i.e. one listed in /etc/shells).
4. If directed by the /etc/ftpchroot file, the session's root directory is changed by chroot() to the directory specified in the /etc/ftpd.conf chroot directive (if set), or to the home directory of the user. However, the user must still supply a password. This feature is intended as a compromise between a fully anonymous account and a fully privileged account. The account should also be set up as for an anonymous account.
5. If the username is anonymous or ftp, an anonymous ftp account must be present in the password file (user ftp). In this case, the user can log in by giving any password (by convention, users give the name of the client host).

   The server performs a chroot() to the directory specified in the /etc/ftpd.conf chroot directive (if set), the -a anondir directory (if set), or to the home directory of the ftp user.

   The server then performs a chdir() to the directory specified in the /etc/ftpd.conf homedir directive (if set), otherwise to /.

   If other restrictions are required (such as disabling of certain commands and the setting of a specific umask), then appropriate entries in /etc/ftpd.conf are required.

   If the first character of the password supplied by an anonymous user is -, then the verbose messages displayed at login and upon a CWD command are suppressed.

Display file escape sequences

When ftpd displays various files back to the client (such as /etc/ftpwelcome and /etc/motd), various escape strings are replaced with information pertinent to the current connection.

The supported escape strings are:

Setting up a restricted ftp subtree

So that system security isn't breached, it's recommended that the ftp subtree be constructed with care; the following rules are recommended:

~ftp

Make the home directory owned by the superuser and unwritable by anyone.

~ftp/bin

Make this directory owned by the superuser and unwritable by anyone. Generally, conversion commands are installed here. The ls utility, which must be present to support the LIST command, should have mode 111.

~ftp/usr/lib

A directory to contain shared libraries. This example uses /usr/lib -- as it is usually part of CS_LIBPATH (see getconf CS_LIBPATH); however, this may vary on custom installations. If no binaries in ~ftp/bin use shared libraries (all statically linked), this directory is not needed; however, the ls utility is usually linked against the shared libc. In such a situation:

# cd ~ftp
# mkdir -m0555 usr
# chown root:root usr
# mkdir -m0555 usr/lib
# chown root:root usr/lib
# cd usr/lib
# cp /lib/libc.so.2 .
# chmod 0555 libc.so.2
# chown root:root libc.so.2
# ln -s libc.so.2 ldqnx.so.2

~ftp/etc

Make this directory owned by the superuser and unwritable by anyone. The /etc/passwd and /etc/group files must be present for the LIST command to be able to produce owner names rather than numbers. The password field in /etc/passwd isn't used and shouldn't contain real encrypted passwords. If present, the contents of the /etc/motd file is printed after a successful login. The /etc/passwd and /etc/group files should be mode 444.

~ftp/pub

Make this directory mode 777 and owned by ftp. If any files are to be accessed via the anonymous account, the user should place them in this directory.

~ftp/incoming

Make this directory where the anonymous users place files they upload. The owners should be user ftp with an appropriate group. Members of this group are the only users with access to these files after they've been uploaded, so these people should know how to deal with them appropriately. To allow anonymous FTP users the ability to see filenames in this directory, set the permissions to 770; otherwise, set to 370.

Anonymous users are able to upload files to this directory, but they're unable to download them, delete them, or overwrite them due to the umask and disabling of the commands mentioned above.

~ftp/tmp

This directory is used to create temporary files which contain the error messages generated by a conversion or LIST command. The owner should be the user ftp. The permissions should be 300.

Don't create this directory if you don't want to enable conversion commands or don't want to allow anonymous users uploading files here (see ~ftp/incoming above). Error messages from conversion or LIST commands won't be returned to the user. (This is the traditional behaviour.) The /etc/ftpd.conf upload directive can be used to prevent users uploading here.

To set up "ftp-only" accounts to provide FTP only with no valid shell login, you can:

• create a /sbin/nologin file
• copy or link /sbin/nologin to /sbin/ftplogin
• add /sbin/ftplogin to the /etc/shells file

This allows you to log in via FTP into accounts that have /sbin/ftplogin as the login shell.

Security considerations

RFC 959 provides no restrictions on the PORT command, and this can lead to security problems since ftpd can be fooled into connecting to any service on any host. If the checkportcmd directive of /etc/ftpd.conf is specified, PORT commands with different host addresses, or TCP ports lower than IPPORT_RESERVED, are rejected. This option prevents "third-party proxy ftp" from working. Use of this option is strongly recommended, and is enabled by default.

By default ftpd uses a port that is one less than the port it is listening on to communicate back to the client for the EPRT, LPTR, and PORT commands. As the default port for ftpd is a privileged port below IPPORT_RESERVED, ftpd retains the ability to switch back to root privileges to bind these ports. In order to increase security by reducing the potential for a bug in ftpd providing a remote root compromise, ftpd permanently drops root privileges if one of the following is true:

1. ftpd runs on a port greater than IPPORT_RESERVED and the user logged in as a "guest" or "chroot" user.
2. ftpd is invoked using -r.

Don't create ~ftp/tmp if you don't want anonymous users to upload files there. The directory is necessary only if you want to display the error messages of conversion commands to the user. If uploads are disabled with the /etc/ftpd.conf directive upload, then this directory cannot be abused by the user in this way, so it should be safe to create.

Files:

/etc/ftpchroot

List of normal users to change root directory for.

/etc/ftpd.conf

Configure file conversions and other settings.

/etc/ftpusers

List of unwelcome and restricted users.

/etc/ftpwelcome

Welcome notice before login.

/etc/motd

Welcome notice after login.

/etc/nologin

If this file exists, display the contents of the file and refuse FTP access.

The ftpd daemon requires the libsocket.so shared library.

Caveats:

The server must run as the superuser to create sockets with privileged port numbers. It maintains an effective user ID of the logged-in user, reverting to the superuser only when binding addresses to sockets. The possible security holes have been extensively scrutinized, but are possibly incomplete.

If the pipe manager isn't running, LIST and other commands may not be available.

See also:

ftp, /etc/ftpchroot, /etc/ftpd.conf, ftpusers, inetd, tftpd, pipe, syslogd

TCP/IP Networking in the Neutrino User's Guide

RFC 959, RFC 1123, RFC 2389, RFC 2428