Internet file transfer protocol daemon (NetBSD)
Syntax:
ftpd [-46DdHlnQqrsUuWwX] [-a anondir] [-C user] [-c confdir]
[-e emailaddr] [-h hostname] [-L xferlogfile]
[-P dataport] [-V version]
Options:
In addition to the options described in the NetBSD documentation,
ftpd supports the following:
- -n
- Don't attempt to translate IP addresses into hostnames.
Description:
The ftpd daemon is an Internet File Transfer Protocol server.
It uses the TCP protocol.
For more information, see the NetBSD documentation at
http://netbsd.gw.com/cgi-bin/man-cgi?ftpd++NetBSD-4.0.
Setting up a restricted ftp subtree
So that system security isn't breached,
it's recommended that the ftp subtree be constructed with care;
the following rules are recommended:
- ~ftp
- Make the home directory owned by the superuser and unwritable by anyone.
- ~ftp/bin
- Make this directory owned by the superuser and unwritable by anyone.
Generally, conversion commands are installed here.
The ls utility, which must be present to support the LIST command,
should have mode 111.
- ~ftp/usr/lib
- A directory to contain shared libraries. This example uses /usr/lib
— as it is usually part of _CS_LIBPATH (see
getconf _CS_LIBPATH); however,
this may vary on custom installations. If no binaries in
~ftp/bin use shared libraries (all statically linked),
this directory is not needed; however, the ls utility is usually linked against the shared
libc. In such a situation:
cd ~ftp
mkdir -m0555 usr
chown root:root usr
mkdir -m0555 usr/lib
chown root:root usr/lib
cd usr/lib
cp /lib/libc.so.3 .
chmod 0555 libc.so.3
chown root:root libc.so.3
ln -s libc.so.3 ldqnx.so.2
Note:
For MIPS targets, you need to name this link
ldqnx.so.3 instead of ldqnx.so.2.
- ~ftp/etc
- Make this directory owned by the superuser and unwritable by anyone.
The /etc/passwd and /etc/group files must be present for the LIST
command to be able to produce owner names rather than numbers.
The password field in /etc/passwd isn't used and shouldn't contain real encrypted passwords.
If there's an /etc/motd file, its contents are displayed
after a successful login.
The /etc/passwd and /etc/group files should be mode 444.
- ~ftp/pub
- Make this directory mode 777 and owned by ftp.
If any files are to be accessed via the anonymous account,
the user should place them in this directory.
- ~ftp/incoming
- Make this directory where the anonymous users place files they upload.
The owners should be user ftp with an appropriate group.
Members of this group are the only users with access to these files after they've been uploaded,
so these people should know how to deal with them appropriately.
To allow anonymous FTP users the ability to see filenames in this directory,
set the permissions to 770; otherwise, set the permissions to 370.
Anonymous users are able to upload files to this directory,
but they're unable to download them, delete them, or overwrite them
due to the umask and disabling of the commands mentioned above.
- ~ftp/tmp
- This directory is used to create temporary files which contain the error messages generated
by a conversion or LIST command.
The owner should be the user ftp.
The permissions should be 300.
Don't create this directory if you don't want to enable conversion commands
or don't want to allow anonymous users uploading files here (see ~ftp/incoming above).
Error messages from conversion or LIST commands won't be returned to the user.
(This is the traditional behavior.)
The /etc/ftpd.conf upload directive can be used to prevent users uploading here.
To set up "ftp-only" accounts to provide FTP only with no valid shell login, you can:
- create a /sbin/nologin file
- copy or link /sbin/nologin to /sbin/ftplogin
- add /sbin/ftplogin to the /etc/shells file
This allows you to log in via FTP into accounts that have /sbin/ftplogin as the login shell.
Based on:
RFC 959,
RFC 1123,
RFC 2389,
RFC 2428