File: inetutils.info,  Node: ftpd invocation,  Next: rexecd invocation,  Prev: syslogd invocation,  Up: Top

21 'ftpd': FTP daemon
*********************

'ftpd' is the Internet File Transfer Protocol server process.  The
server uses the TCP protocol and listens at the port specified in the
'ftp' service specification.

     ftpd [OPTION]...

'-4'
'--ipv4'
     Daemon uses only IPv4 addressing.  Ignored in inetd mode.

'-6'
'--ipv6'
     Daemon uses only IPv6 addressing.  Ignored in inetd mode.

'-A'
'--anonymous-only'
     Only anonymous login is allowed.

'-a AUTH'
'--auth=AUTH'
     Specify what authentication mechanism to use for incoming
     connections.  Possible values are: 'kerberos', 'kerberos5', 'opie',
     'pam', and 'default'.

     Anonymous logins will continue to work when this option is used,
     unless the user 'ftp' is removed from the system.

'-D'
'--daemon'
     'ftpd' enters daemon-mode.  That allows 'ftpd' to be run without
     'inetd'.

'-d'
'--debug'
     Debugging information is written to the 'syslog' using facility
     'LOG_FTP'.

'-l'
'--logging'
     Each successful and failed ftp session is logged using 'syslog'
     with a facility of 'LOG_FTP'.  If this option is specified twice,
     the retrieve ('get'), store ('put'), append, delete, make
     directory, remove directory and rename operations and their
     filename arguments are also logged.

'--non-rfc2577'
     Do not follow the suggestion of RFC 2577 to suppress messages that
     could help an attacker to conduct user name enumeration.  This
     option allows the server to return with an error message
     immediately upon receipt of a user name.  Such information includes
     non-existence claims and expiration claims.  The ideal mode would
     otherwise be to fake the relevance of asking for a password, and
     only thereafter report an invalid login.

'-p PIDFILE'
'--pidfile=PIDFILE'
     Change default location of PIDFILE.

'-q'
'--no-version'
     Quiet mode.  No information about the version of the 'ftpd' is
     given to the client.

'-T'
'--max-timeout'
     A client may also request a different timeout period; the maximum
     period allowed may be set to timeout seconds with the '-T' option.
     The default limit is 2 hours.

'-t TIMEOUT'
'--timeout=TIMEOUT'
     The inactivity timeout period is set to timeout seconds (the
     default is 15 minutes).

'-u UMASK'
'--umask=UMASK'
     Set default umask, expressed in base 8.

   The file '/etc/nologin' can be used to disable FTP access.  If the
file exists, 'ftpd' displays it and exits.  If the file
'/etc/ftpwelcome' exists, 'ftpd' prints it before issuing the 'ready'
message.  If the file '/etc/motd' exists, 'ftpd' prints it after a
successful login.

   If this server was compiled with PAM support, then any non-anonymous
connection request will also be checked for settings pertaining to the
PAM service 'ftp', before finally being accepted.

   Linux-PAM is particular in that it also provides a module
'pam_ftp.so' influencing even anonymous access.  By convention the
present server relies on the functionality in that module when built on
relevant systems.  However, the module is known to be partially broken
since ten years back, when one compares the claims in its manual page,
so not all claimed trickery is available!

21.1 Standards
==============

The FTP server currently supports the following FTP requests.  The
letter case of any request is ignored.

Request                Description
--------------------------------------------------------------------------
ABOR                   abort previous command
ACCT                   specify account (ignored)
ALLO                   allocate storage (vacuously)
APPE                   append to a file
CDUP                   change to parent of current working directory
CWD                    change working directory
DELE                   delete a file
EPSV                   extended passive transfer request
EPRT                   specify data connection port
HELP                   give help information
LIST                   give list files in a directory ("ls -lgA")
LPRT                   specify data connection port
LPSV                   long passive transfer request
MKD                    make a directory
MDTM                   show last modification time of file
MODE                   specify data transfer mode
NLST                   give name list of files in directory
NOOP                   do nothing
PASS                   specify password
PASV                   prepare for server-to-server transfer
PORT                   specify data connection port
PWD                    print the current working directory
QUIT                   terminate session
REST                   restart incomplete transfer
RETR                   retrieve a file
RMD                    remove a directory
RNFR                   specify rename-from file name
RNTO                   specify rename-to file name
SITE                   non-standard commands
SIZE                   return size of file
STAT                   return status of server
STOR                   store a file
STOU                   store a file with a unique name
STRU                   specify data transfer structure
SYST                   show operating system type of server system
TYPE                   specify data transfer type
USER                   specify user name
XCUP                   change to parent of current working directory
                       (deprecated)
XCWD                   change working directory (deprecated)
XMKD                   make a directory (deprecated)
XPWD                   print the current working directory (deprecated)
XRMD                   remove a directory (deprecated)

   The following non-standard, or UNIX specific, commands are supported
by the 'SITE' request.

Request                Description
UMASK                  change umask, e.g.  'SITE UMASK 002'
IDLE                   set idle-timer, e.g.  'SITE IDLE 60'
CHMOD                  change mode of a file, e.g.  'SITE CHMOD0
                       0CHMOD1 1CHMOD2'
HELP                   give help information.

   The remaining FTP requests specified in RFC 959 are recognized, but
not implemented.  The extensions 'MDTM', 'REST', and 'SIZE' are
specified in RFC 3659, while 'EPRT' and 'EPSV' appear in RFC 2428,
'LPRT' and 'LPSV' in RFC 1639.

   The ftp server will abort an active file transfer only when the
'ABOR' command is preceded by a Telnet 'Interrupt Process' (IP) signal
and a Telnet 'Synch' signal in the command Telnet stream, as described
in Internet RFC 959.  If a 'STAT' command is received during a data
transfer, preceded by a Telnet IP and Synch, transfer status will be
returned.

   'ftpd' interprets file names according to the globbing conventions
used by 'csh'.  This allows users to utilize the metacharacters
'*?[]{}~'.

   The server applies the suggestions in RFC 2577, but the legacy
behaviour with informational content in denials can be restored using
the option '--non-rfc2577'.

21.2 Authentication
===================

'ftpd' authenticates users according to four rules.

  1. The login name must be in the password data base, '/etc/passwd',
     and must not have a null password.  In this case a password must be
     provided by the client before any file operations can be performed.

  2. The login name must not appear in the file '/etc/ftpusers'.

  3. The user must have a standard shell.

  4. If the user name is 'anonymous' or 'ftp', an anonymous ftp account
     must be present in the password file (user 'ftp').  In this case
     the user is allowed to log in by specifying any password (by
     convention an email address for the user should be used as the
     password).

   A further access mechanism is provided by the file '/etc/ftpchroot'.
A user mentioned therein will have all access confined to the subtree
rooted at the home directory specified in '/etc/passwd'.

   In the case of anonymous access, 'ftpd' takes special measures to
restrict the client's access privileges.  The server always performs a
chroot to the home directory of the 'ftp' user.

   In order that system security is not breached, it is recommended that
the 'ftp' subtree be constructed with care, following these rules:

'~ftp'
     Make the home directory owned by 'root' and not writable by anyone.

'~ftp/bin'
     Make this directory owned by 'root' and not writable by anyone
     (mode 555).  The program 'ls' must be present to support the list
     command, unless the server was compiled with libls support.  This
     program should be mode 111.

'~ftp/etc'
     Make this directory owned by 'root' and not writable by anyone
     (mode 555).  The files 'passwd' and 'group' must be present for the
     'ls' command to be able to produce owner names rather than numbers.
     The password field in 'passwd' is not used, and should not contain
     real passwords.  The file 'motd', if present, will be printed after
     a successful login.  These files should be mode 444.

'~ftp/pub'
     Make this directory mode 777 and owned by 'ftp'.  Guests can then
     place files which are to be accessible via the anonymous account in
     this directory.

21.3 Configuration files
========================

''/etc/ftpchroot''
     List of users to enclose in a chrooted directory.  The anonymous
     user 'ftp' is always considered to be a member of this list,
     explicit or not.

''/etc/ftpusers''
     List of unwelcome/restricted users, always to be denied access.

''/etc/ftpwelcome''
     Welcome notice printed before server identification and any
     authentication exchange.

''/etc/motd''
     Welcome notice presented after completed login.

''/etc/nologin''
     If present, the contents are displayed and all further access is
     refused.

21.4 File format of ftpusers and ftpchroot.
===========================================

The files '/etc/ftpusers' and '/etc/ftpchroot' share a common file
format.  For better conformity with other implementations, each line is
understood as consisting of fields separated by spaces, or by horizontal
tabulators.  Only the first non-empty field is examined at present.
Both files are used for matching against a user name, desiring to use
the FTP service.

   Whenever the first printable character is a hash '#', the input line
is taken as a comment, and is ignored.  Lines lacking non-empty fields
are likewise ignored.

   A field consisting of a single at-sign '@', is treated as a wildcard
and matches every input.

   A field commencing with an at-sign '@' and then continuing with an
identifier, is understood as giving the name of a group.  Should this
name exist in '/etc/groups', and the user name be a member of this same
group, then the user name matches.

   In all other cases, the field is taken as the identifier of a user,
with which the requesting user is compared for verbatim match.

   It is worthwhile to observe from the above cases, that a single '@'
on a line by itself in '/etc/ftpchroot', will enforce chrooting upon
every user allowed to access the FTP service.  This gives a Draconian,
protective configuration.