1.\" $NetBSD: ftpd.8,v 1.14 1997/06/14 08:43:30 lukem Exp $ 2.\" 3.\" Copyright (c) 1985, 1988, 1991, 1993 4.\" The Regents of the University of California. All rights reserved. 5.\" 6.\" Redistribution and use in source and binary forms, with or without 7.\" modification, are permitted provided that the following conditions 8.\" are met: 9.\" 1. Redistributions of source code must retain the above copyright 10.\" notice, this list of conditions and the following disclaimer. 11.\" 2. Redistributions in binary form must reproduce the above copyright 12.\" notice, this list of conditions and the following disclaimer in the 13.\" documentation and/or other materials provided with the distribution. 14.\" 3. All advertising materials mentioning features or use of this software 15.\" must display the following acknowledgement: 16.\" This product includes software developed by the University of 17.\" California, Berkeley and its contributors. 18.\" 4. Neither the name of the University nor the names of its contributors 19.\" may be used to endorse or promote products derived from this software 20.\" without specific prior written permission. 21.\" 22.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 23.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 24.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 25.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 26.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 27.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 28.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 29.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 30.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 31.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 32.\" SUCH DAMAGE. 33.\" 34.\" @(#)ftpd.8 8.2 (Berkeley) 4/19/94 35.\" 36.Dd June 10, 1997 37.Dt FTPD 8 38.Os NetBSD 39.Sh NAME 40.Nm ftpd 41.Nd 42Internet File Transfer Protocol server 43.Sh SYNOPSIS 44.Nm 45.Op Fl dl 46.Op Fl a Ar anondir 47.Sh DESCRIPTION 48.Nm 49is the 50Internet File Transfer Protocol 51server process. The server uses the 52.Tn TCP 53protocol 54and listens at the port specified in the 55.Dq ftp 56service specification; see 57.Xr services 5 . 58.Pp 59Available options: 60.Bl -tag -width Ds 61.It Fl a 62Define the directory to 63.Xr chroot 2 64into for anonymous logins. 65Default is the home directory for the ftp user. 66.It Fl d 67Debugging information is written to the syslog using LOG_FTP. 68.It Fl l 69Each successful and failed 70.Xr ftp 1 71session is logged using syslog with a facility of LOG_FTP. 72If this option is specified twice, the retrieve (get), store (put), append, 73delete, make directory, remove directory and rename operations and 74their filename arguments are also logged. 75.El 76.Pp 77The file 78.Pa /etc/nologin 79can be used to disable ftp access. 80If the file exists, 81.Nm 82displays it and exits. 83If the file 84.Pa /etc/ftpwelcome 85exists, 86.Nm 87prints it before issuing the 88.Dq ready 89message. 90If the file 91.Pa /etc/motd 92exists, 93.Nm 94prints it after a successful login. 95.Pp 96The ftp server currently supports the following ftp requests. 97The case of the requests is ignored. 98.Bl -column "Request" -offset indent 99.It Request Ta "Description" 100.It ABOR Ta "abort previous command" 101.It ACCT Ta "specify account (ignored)" 102.It ALLO Ta "allocate storage (vacuously)" 103.It APPE Ta "append to a file" 104.It CDUP Ta "change to parent of current working directory" 105.It CWD Ta "change working directory" 106.It DELE Ta "delete a file" 107.It HELP Ta "give help information" 108.It LIST Ta "give list files in a directory" Pq Dq Li "ls -lgA" 109.It MKD Ta "make a directory" 110.It MDTM Ta "show last modification time of file" 111.It MODE Ta "specify data transfer" Em mode 112.It NLST Ta "give name list of files in directory" 113.It NOOP Ta "do nothing" 114.It PASS Ta "specify password" 115.It PASV Ta "prepare for server-to-server transfer" 116.It PORT Ta "specify data connection port" 117.It PWD Ta "print the current working directory" 118.It QUIT Ta "terminate session" 119.It REST Ta "restart incomplete transfer" 120.It RETR Ta "retrieve a file" 121.It RMD Ta "remove a directory" 122.It RNFR Ta "specify rename-from file name" 123.It RNTO Ta "specify rename-to file name" 124.It SITE Ta "non-standard commands (see next section)" 125.It SIZE Ta "return size of file" 126.It STAT Ta "return status of server" 127.It STOR Ta "store a file" 128.It STOU Ta "store a file with a unique name" 129.It STRU Ta "specify data transfer" Em structure 130.It SYST Ta "show operating system type of server system" 131.It TYPE Ta "specify data transfer" Em type 132.It USER Ta "specify user name" 133.It XCUP Ta "change to parent of current working directory (deprecated)" 134.It XCWD Ta "change working directory (deprecated)" 135.It XMKD Ta "make a directory (deprecated)" 136.It XPWD Ta "print the current working directory (deprecated)" 137.It XRMD Ta "remove a directory (deprecated)" 138.El 139.Pp 140The following non-standard or 141.Tn UNIX 142specific commands are supported 143by the 144SITE request. 145.Pp 146.Bl -column Request -offset indent 147.It Sy Request Ta Sy Description 148.It CHMOD Ta "change mode of a file, e.g. ``SITE CHMOD 755 filename''" 149.It HELP Ta "give help information." 150.It IDLE Ta "set idle-timer, e.g. ``SITE IDLE 60''" 151.It UMASK Ta "change umask, e.g. ``SITE UMASK 002''" 152.El 153.Pp 154The remaining ftp requests specified in Internet RFC 959 155are 156recognized, but not implemented. 157MDTM and SIZE are not specified in RFC 959, but will appear in the 158next updated FTP RFC. 159.Pp 160The ftp server will abort an active file transfer only when the 161ABOR 162command is preceded by a Telnet "Interrupt Process" (IP) 163signal and a Telnet "Synch" signal in the command Telnet stream, 164as described in Internet RFC 959. 165If a 166STAT 167command is received during a data transfer, preceded by a Telnet IP 168and Synch, transfer status will be returned. 169.Pp 170.Nm 171interprets file names according to the 172.Dq globbing 173conventions used by 174.Xr csh 1 . 175This allows users to utilize the metacharacters 176.Dq Li \&*?[]{}~ . 177.Ss User authentication 178.Nm 179authenticates users according to five rules. 180.Pp 181.Bl -enum -offset indent 182.It 183The login name must be in the password data base, 184.Pa /etc/pwd.db , 185and not have a null password. 186In this case a password must be provided by the client before any 187file operations may be performed. 188If the user has an S/Key key, the response from a successful USER 189command will include an S/Key challenge. The client may choose to respond 190with a PASS command giving either a standard password or an S/Key 191one-time password. The server will automatically determine which type of 192password it has been given and attempt to authenticate accordingly. See 193.Xr skey 1 194for more information on S/Key authentication. S/Key is a Trademark of 195Bellcore. 196.It 197The login name must be allowed based on the information in 198.Pa /etc/ftpusers 199(see below). 200.It 201The user must have a standard shell returned by 202.Xr getusershell 3 . 203.It 204If the user name appears in the file 205.Pa /etc/ftpchroot 206the session's root will be changed to the user's login directory by 207.Xr chroot 2 208as for an 209.Dq anonymous 210or 211.Dq ftp 212account (see next item). However, the user must still supply a password. 213This feature is intended as a compromise between a fully anonymous account 214and a fully privileged account. The account should also be set up as for an 215anonymous account. 216.It 217If the user name is 218.Dq anonymous 219or 220.Dq ftp , 221an 222anonymous ftp account must be present in the password 223file (user 224.Dq ftp ) . 225In this case the user is allowed 226to log in by specifying any password (by convention an email address for 227the user should be used as the password). 228The server performs a 229.Xr chroot 2 230to the home directory of the 231.Dq ftp 232user. 233If other restrictions are required (such as disabling of certain 234commands and the setting of a specific umask), then appropriate 235entries in 236.Pa /etc/ftpd.conf 237are required. 238.El 239.Ss /etc/ftpusers 240The file 241.Pa /etc/ftpusers 242is used to determine which users may use ftp. 243If the file does not exist, all users are denied access. If it 244does exist, each line is a a comment starting with 245.Dq # 246or a glob pattern that uses the same syntax as /bin/sh, 247optionally followed by whitespace and 248.Dq allow 249or 250.Dq deny . 251Each glob pattern is compared in turn against the username 252until a match is found. If the word following the matched glob 253pattern is 254.Dq allow 255the user is granted access; if the word is 256anything else, or nothing at all, the user is denied access. 257(No further comparisons are attempted after the first successful match.) 258If no match is found, the user is granted access. 259This syntax is backward-compatable with the old syntax. 260.Pp 261If a user requests a guest login, the ftp server checks to see that 262both 263.Dq anonymous 264and 265.Dq ftp 266have access, so if you deny all users by default, you will need to add both 267.Dq "anonymous allow" 268and 269.Dq "ftp allow" 270to 271.Pa /etc/ftpusers 272in order to allow guest logins. 273.Ss /etc/ftpd.conf 274The file 275.Pa /etc/ftpd.conf 276is used to configure various options. 277Each line starting with a 278.Dq # 279is a comment (and ignored), and all other non-blank lines are treated 280as configuration directives. 281.Pp 282Each configuration line may be one of: 283.Bl -tag -width 4n 284.It Xo Sy conversion Ar class 285.Ar suffix Op Ar "type disable command" 286.Xc 287Define an automatic in-line file conversion. 288If a file to retrieve ends in 289.Ar suffix , 290and a real file (sans 291.Ar suffix ) 292exists, then the output of 293.Ar command 294is returned instead of the contents of the file. 295.Pp 296.Bl -tag -width "disable" -offset indent 297.It Ar suffix 298The suffix to initiate the conversion. 299.It Ar type 300A list of valid filetypes for the conversion. 301Valid types are: 302.Sq f 303(file), and 304.Sq d 305(directory). 306.It Ar disable 307The name of file that will prevent conversion if it exists. 308A filename of 309.Pa \&. 310will prevent this disabling action. 311.It Ar command 312The command to run for the conversion. 313The first word should be the full path name 314of the command, as 315.Xr execv 3 316is used to execute the command. 317The first instance of 318.Sq %s 319in 320.Ar command 321is replaced with the requested file (sans 322.Ar suffix ) . 323.El 324.Pp 325Conversion directives specified later in the file override earlier 326conversions with the same suffix. The order in which conversions is 327matched is the reverse of their order in the file (i.e., a LIFO). 328.It Sy display Ar class Op Ar file 329If 330.Ar file 331isn't given or 332.Ar class 333is 334.Dq none , 335disable this. 336Otherwise, each time the user enters a new directory, check if 337.Ar file 338exists, and if so, display its contents to the user. 339.It Sy maxtimeout Ar class Ar time 340Set the maximum timeout period that a client may request, 341defaulting to two hours. 342This cannot be lesser than 30 seconds, or the value for 343.Sy timeout . 344Ignored if class is 345.Dq none 346or 347.Ar time 348isn't specified. 349.It Sy modify Ar class Op Sy off 350If class is 351.Dq none 352or 353.Sy off 354is given, disable the following commands: 355CHMOD, DELE, MKD, RMD, and UMASK. 356Otherwise, enable them. 357.It Sy notify Ar class Op Ar fileglob 358If 359.Ar fileglob 360isn't given or 361.Ar class 362is 363.Dq none , 364disable this. 365Otherwise, each time the user enters a new directory, 366notify the user of any files matching 367.Ar fileglob . 368.It Sy timeout Ar class Ar time 369Set the inactivity timeout period. 370(the default is fifteen minutes). 371This cannot be lesser than 30 seconds, or greater than the value for 372.Sy maxtimeout . 373Ignored if class is 374.Dq none 375or 376.Ar time 377isn't specified. 378.It Sy umask Ar class Ar umaskval 379Set the umask to 380.Ar umaskval . 381Ignored if class is 382.Dq none 383or 384.Ar umaskval 385isn't specified. 386.El 387.Pp 388In any configuration line, 389.Ar class 390is one of: 391.Bl -tag -width "chroot" -compact -offset indent 392.It Sy real 393Normal user logins. 394.It Sy chroot 395Users that have been 396.Xr chroot 2 ed. 397.It Sy guest 398.Dq anonymous 399and 400.Dq ftp 401users. 402.It Sy all 403Matches any class. 404.It Sy none 405Matches no class. 406.El 407.Pp 408The following defaults are used: 409.Bd -literal -offset indent -compact 410display none 411maxtimeout all 7200 # 2 hours 412modify all 413modify guest off 414notify none 415timeout all 900 # 15 minutes 416umask all 027 417umask guest 0707 418.Ed 419.Pp 420Directives that appear later in the file override settings by previous 421directives. This allows 422.Sq wildcard 423entries to define defaults, and then have class-specific overrides. 424.Pp 425The 426STAT 427command will return the class settings for the current user as defined by 428.Pa /etc/ftpd.conf . 429.Ss Setting up a restricted ftp subtree 430In order that system security is not breached, it is recommended 431that the 432subtrees for the 433.Dq ftp 434and 435.Dq chroot 436accounts be constructed with care, following these rules 437(replace 438.Dq ftp 439in the following directory names 440with the appropriate account name for 441.Sq chroot 442users): 443.Bl -tag -width "~ftp/incoming" -offset indent 444.It Pa ~ftp 445Make the home directory owned by 446.Dq root 447and unwritable by anyone. 448.It Pa ~ftp/bin 449Make this directory owned by 450.Dq root 451and unwritable by anyone (mode 555). 452The program 453.Xr ls 1 454must be present to support the list command. 455This program should be mode 111. 456.It Pa ~ftp/etc 457Make this directory owned by 458.Dq root 459and unwritable by anyone (mode 555). 460The files 461.Pa pwd.db 462(see 463.Xr passwd 5 ) 464and 465.Pa group 466(see 467.Xr group 5 ) 468must be present for the 469.Xr ls 470command to be able to produce owner names rather than numbers. 471The password field in 472.Xr passwd 473is not used, and should not contain real passwords. 474The file 475.Pa motd , 476if present, will be printed after a successful login. 477These files should be mode 444. 478.It Pa ~ftp/pub 479This directory and the subdirectories beneath it should be owned 480by the users and groups responsible for placing files in them, 481and be writable only by them (mode 755 or 775). They should 482.Em not 483be owned or writable by ftp or its group. 484.It Pa ~ftp/incoming 485This directory is where anonymous users place files they upload. 486The owners should be the user 487.Dq ftp 488and an appropriate group. 489Members of this group will be the only users with access to these 490files after they have been uploaded; these should be people who 491know how to deal with them appropriately. If you wish anonymous 492ftp users to be able to see the names of the files in this directory 493the permissions should be 770, otherwise they should be 370. 494.Pp 495Anonymous users will be able to upload files to this directory, 496but they will not be able to download them, delete them, or overwrite 497them, due to the umask and disabling of the commands mentioned 498above. 499.El 500.Sh FILES 501.Bl -tag -width /etc/ftpwelcome -compact 502.It Pa /etc/ftpchroot 503List of normal users who should be chroot'd. 504.It Pa /etc/ftpd.conf 505Configure file conversions and other settings. 506.It Pa /etc/ftpusers 507List of unwelcome/restricted users. 508.It Pa /etc/ftpwelcome 509Welcome notice. 510.It Pa /etc/motd 511Welcome notice after login. 512.It Pa /etc/nologin 513If it exists, displayed and access is refused. 514.El 515.Sh SEE ALSO 516.Xr ftp 1 , 517.Xr skey 1 , 518.Xr getusershell 3 , 519.Xr syslogd 8 520.Sh BUGS 521The server must run as the super-user 522to create sockets with privileged port numbers. It maintains 523an effective user id of the logged in user, reverting to 524the super-user only when binding addresses to sockets. The 525possible security holes have been extensively 526scrutinized, but are possibly incomplete. 527.Pp 528The feedback to the client is inadequate in the case of an 529error that occurs during a retrieval that uses a 530.Dq conversion 531command 532(refer to 533.Sx /etc/ftpd.conf ) . 534.Sh HISTORY 535The 536.Nm 537command appeared in 538.Bx 4.2 . 539.Pp 540The 541.Pa /etc/ftpd.conf 542functionality was implemented in 543.Nx 1.3 544by Luke Mewburn, based on work by Simon Burge. 545