ftpd

Internet file transfer protocol daemon (NetBSD)

Syntax:

ftpd [-46DdHlnQqrsUuWwX] [-a anondir] [-C user] [-c confdir]
     [-e emailaddr] [-h hostname] [-L xferlogfile]
     [-P dataport] [-V version]

Runs on:

Neutrino

Options:

In addition to the options described in the NetBSD documentation, ftpd supports the following:

-n

Don't attempt to translate IP addresses into hostnames.

Description:

The ftpd daemon is an Internet File Transfer Protocol server. It uses the TCP protocol. For more information, see the NetBSD documentation at http://netbsd.gw.com/cgi-bin/man-cgi?ftpd++NetBSD-4.0.

Setting up a restricted ftp subtree

So that system security isn't breached, it's recommended that the ftp subtree be constructed with care; the following rules are recommended:

~ftp

Make the home directory owned by the superuser and unwritable by anyone.

~ftp/bin

Make this directory owned by the superuser and unwritable by anyone. Generally, conversion commands are installed here. The ls utility, which must be present to support the LIST command, should have mode 111.

~ftp/usr/lib

A directory to contain shared libraries. This example uses /usr/lib — as it is usually part of _CS_LIBPATH (see getconf _CS_LIBPATH); however, this may vary on custom installations. If no binaries in ~ftp/bin use shared libraries (all statically linked), this directory is not needed; however, the ls utility is usually linked against the shared libc. In such a situation:

# cd ~ftp
# mkdir -m0555 usr
# chown root:root usr
# mkdir -m0555 usr/lib
# chown root:root usr/lib
# cd usr/lib
# cp /lib/libc.so.3 .
# chmod 0555 libc.so.3
# chown root:root libc.so.3
# ln -s libc.so.3 ldqnx.so.2

~ftp/etc

Make this directory owned by the superuser and unwritable by anyone. The /etc/passwd and /etc/group files must be present for the LIST command to be able to produce owner names rather than numbers. The password field in /etc/passwd isn't used and shouldn't contain real encrypted passwords. If there's an /etc/motd file, its contents are displayed after a successful login. The /etc/passwd and /etc/group files should be mode 444.

~ftp/pub

Make this directory mode 777 and owned by ftp. If any files are to be accessed via the anonymous account, the user should place them in this directory.

~ftp/incoming

Make this directory where the anonymous users place files they upload. The owners should be user ftp with an appropriate group. Members of this group are the only users with access to these files after they've been uploaded, so these people should know how to deal with them appropriately. To allow anonymous FTP users the ability to see filenames in this directory, set the permissions to 770; otherwise, set the permissions to 370.

Anonymous users are able to upload files to this directory, but they're unable to download them, delete them, or overwrite them due to the umask and disabling of the commands mentioned above.

~ftp/tmp

This directory is used to create temporary files which contain the error messages generated by a conversion or LIST command. The owner should be the user ftp. The permissions should be 300.

Don't create this directory if you don't want to enable conversion commands or don't want to allow anonymous users uploading files here (see ~ftp/incoming above). Error messages from conversion or LIST commands won't be returned to the user. (This is the traditional behavior.) The /etc/ftpd.conf upload directive can be used to prevent users uploading here.

To set up “ftp-only” accounts to provide FTP only with no valid shell login, you can:

• create a /sbin/nologin file
• copy or link /sbin/nologin to /sbin/ftplogin
• add /sbin/ftplogin to the /etc/shells file

This allows you to log in via FTP into accounts that have /sbin/ftplogin as the login shell.

See also:

ftp, /etc/ftpchroot, /etc/ftpd.conf, ftpusers, inetd, tftpd, pipe, syslogd

TCP/IP Networking in the Neutrino User's Guide

Based on RFC 959, RFC 1123, RFC 2389, RFC 2428