21.1 Standards

The FTP server currently supports the following FTP requests. The letter case of any request is ignored.

The following non-standard, or UNIX specific, commands are supported by the SITE request.

The remaining FTP requests specified in RFC 959 are recognized, but not implemented. The extensions MDTM, REST, and SIZE are specified in RFC 3659, while EPRT and EPSV appear in RFC 2428, LPRT and LPSV in RFC 1639.

The ftp server will abort an active file transfer only when the ABOR command is preceded by a Telnet ‘Interrupt Process’ (IP) signal and a Telnet ‘Synch’ signal in the command Telnet stream, as described in Internet RFC 959. If a STAT command is received during a data transfer, preceded by a Telnet IP and Synch, transfer status will be returned.

ftpd interprets file names according to the globbing conventions used by csh. This allows users to utilize the metacharacters ‘*?[]{}~’.

The server applies the suggestions in RFC 2577, but the legacy behaviour with informational content in denials can be restored using the option --non-rfc2577.

21.2 Authentication

ftpd authenticates users according to four rules.

1. The login name must be in the password data base, /etc/passwd, and must not have a null password. In this case a password must be provided by the client before any file operations can be performed.
2. The login name must not appear in the file /etc/ftpusers.
3. The user must have a standard shell.
4. If the user name is ‘anonymous’ or ‘ftp’, an anonymous ftp account must be present in the password file (user ‘ftp’). In this case the user is allowed to log in by specifying any password (by convention an email address for the user should be used as the password).

A further access mechanism is provided by the file /etc/ftpchroot. A user mentioned therein will have all access confined to the subtree rooted at the home directory specified in /etc/passwd.

In the case of anonymous access, ftpd takes special measures to restrict the client’s access privileges. The server always performs a chroot to the home directory of the ‘ftp’ user.

In order that system security is not breached, it is recommended that the ‘ftp’ subtree be constructed with care, following these rules:

~ftp

Make the home directory owned by ‘root’ and not writable by anyone.

~ftp/bin

Make this directory owned by ‘root’ and not writable by anyone (mode 555). The program ls must be present to support the list command, unless the server was compiled with libls support. This program should be mode 111.

~ftp/etc

Make this directory owned by ‘root’ and not writable by anyone (mode 555). The files passwd and group must be present for the ls command to be able to produce owner names rather than numbers. The password field in passwd is not used, and should not contain real passwords. The file motd, if present, will be printed after a successful login. These files should be mode 444.

~ftp/pub

Make this directory mode 777 and owned by ‘ftp’. Guests can then place files which are to be accessible via the anonymous account in this directory.

21.3 Configuration files

‘/etc/ftpchroot’

List of users to enclose in a chrooted directory. The anonymous user ‘ftp’ is always considered to be a member of this list, explicit or not.

‘/etc/ftpusers’

List of unwelcome/restricted users, always to be denied access.

‘/etc/ftpwelcome’

Welcome notice printed before server identification and any authentication exchange.

‘/etc/motd’

Welcome notice presented after completed login.

‘/etc/nologin’

If present, the contents are displayed and all further access is refused.

21.4 File format of ftpusers and ftpchroot.

The files /etc/ftpusers and /etc/ftpchroot share a common file format. For better conformity with other implementations, each line is understood as consisting of fields separated by spaces, or by horizontal tabulators. Only the first non-empty field is examined at present. Both files are used for matching against a user name, desiring to use the FTP service.

Whenever the first printable character is a hash ‘#’, the input line is taken as a comment, and is ignored. Lines lacking non-empty fields are likewise ignored.

A field consisting of a single at-sign ‘@’, is treated as a wildcard and matches every input.

A field commencing with an at-sign ‘@’ and then continuing with an identifier, is understood as giving the name of a group. Should this name exist in /etc/groups, and the user name be a member of this same group, then the user name matches.

In all other cases, the field is taken as the identifier of a user, with which the requesting user is compared for verbatim match.

It is worthwhile to observe from the above cases, that a single ‘@’ on a line by itself in /etc/ftpchroot, will enforce chrooting upon every user allowed to access the FTP service. This gives a Draconian, protective configuration.