| blob | c62d3d391f8c5c76ccde2210422b8ef2296a879e |
1 .\" $NetBSD: ftpd.8,v 1.85 2009/05/01 10:53:27 wiz Exp $
2 .\"
3 .\" Copyright (c) 1997-2008 The NetBSD Foundation, Inc.
4 .\" All rights reserved.
5 .\"
6 .\" This code is derived from software contributed to The NetBSD Foundation
7 .\" by Luke Mewburn.
8 .\"
9 .\" Redistribution and use in source and binary forms, with or without
10 .\" modification, are permitted provided that the following conditions
11 .\" are met:
12 .\" 1. Redistributions of source code must retain the above copyright
13 .\" notice, this list of conditions and the following disclaimer.
14 .\" 2. Redistributions in binary form must reproduce the above copyright
15 .\" notice, this list of conditions and the following disclaimer in the
16 .\" documentation and/or other materials provided with the distribution.
17 .\"
18 .\" THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
19 .\" ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
20 .\" TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
21 .\" PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
22 .\" BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
23 .\" CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
24 .\" SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
25 .\" INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
26 .\" CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
27 .\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
28 .\" POSSIBILITY OF SUCH DAMAGE.
29 .\"
30 .\" Copyright (c) 1985, 1988, 1991, 1993
31 .\" The Regents of the University of California. All rights reserved.
32 .\"
33 .\" Redistribution and use in source and binary forms, with or without
34 .\" modification, are permitted provided that the following conditions
35 .\" are met:
36 .\" 1. Redistributions of source code must retain the above copyright
37 .\" notice, this list of conditions and the following disclaimer.
38 .\" 2. Redistributions in binary form must reproduce the above copyright
39 .\" notice, this list of conditions and the following disclaimer in the
40 .\" documentation and/or other materials provided with the distribution.
41 .\" 3. Neither the name of the University nor the names of its contributors
42 .\" may be used to endorse or promote products derived from this software
43 .\" without specific prior written permission.
44 .\"
45 .\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
46 .\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
47 .\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
48 .\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
49 .\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
50 .\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
51 .\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
52 .\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
53 .\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
54 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
55 .\" SUCH DAMAGE.
56 .\"
57 .\" @(#)ftpd.8 8.2 (Berkeley) 4/19/94
58 .\"
59 .Dd May 1, 2009
60 .Dt FTPD 8
61 .Os
62 .Sh NAME
63 .Nm ftpd
64 .Nd
65 Internet File Transfer Protocol server
66 .Sh SYNOPSIS
67 .Nm
68 .Op Fl 46DdHlnQqrsUuWwX
69 .Op Fl a Ar anondir
70 .Op Fl C Ar user Ns Op @ Ns Ar host
71 .Op Fl c Ar confdir
72 .Op Fl e Ar emailaddr
73 .Op Fl h Ar hostname
74 .Op Fl L Ar xferlogfile
75 .Op Fl P Ar dataport
76 .Op Fl V Ar version
77 .Sh DESCRIPTION
78 .Nm
79 is the Internet File Transfer Protocol server process.
80 The server uses the
81 .Tn TCP
82 protocol and listens at the port specified in the
83 .Dq ftp
84 service specification; see
85 .Xr services 5 .
86 .Pp
87 Available options:
88 .Bl -tag -width Ds
89 .It Fl 4
90 When
91 .Fl D
92 is specified, bind to IPv4 addresses only.
93 .It Fl 6
94 When
95 .Fl D
96 is specified, bind to IPv6 addresses only.
97 .It Fl a Ar anondir
98 Define
99 .Ar anondir
100 as the directory to
101 .Xr chroot 2
102 into for anonymous logins.
103 Default is the home directory for the ftp user.
104 This can also be specified with the
105 .Xr ftpd.conf 5
106 .Sy chroot
107 directive.
108 .It Fl C Ar user Ns Op @ Ns Ar host
109 Check whether
110 .Ar user
111 .Po
112 as if connecting from
113 .Ar host ,
114 if provided
115 .Pc
116 would be granted access under
117 the restrictions given in
118 .Xr ftpusers 5 ,
119 and exit without attempting a connection.
120 .Nm
121 exits with an exit code of 0 if access would be granted, or 1 otherwise.
122 This can be useful for testing configurations.
123 .It Fl c Ar confdir
124 Change the root directory of the configuration files from
125 .Dq Pa /etc
126 to
127 .Ar confdir .
128 This changes the directory for the following files:
129 .Pa /etc/ftpchroot ,
130 .Pa /etc/ftpusers ,
131 .Pa /etc/ftpwelcome ,
132 .Pa /etc/motd ,
133 and the file specified by the
134 .Xr ftpd.conf 5
135 .Sy limit
136 directive.
137 .It Fl D
138 Run as daemon.
139 .Nm
140 will listen on the default FTP port for incoming connections
141 and fork a child for each connection.
142 This is lower overhead than starting
143 .Nm
144 from
145 .Xr inetd 8
146 and thus might be useful on busy servers to reduce load.
147 .It Fl d
148 Debugging information is written to the syslog using a facility of
149 .Dv LOG_FTP .
150 .It Fl e Ar emailaddr
151 Use
152 .Ar emailaddr
153 for the
154 .Dq "\&%E"
155 escape sequence (see
156 .Sx Display file escape sequences )
157 .It Fl H
158 Equivalent to
159 .Do
160 -h
161 `hostname`
162 .Dc .
163 .It Fl h Ar hostname
164 Explicitly set the hostname to advertise as to
165 .Ar hostname .
166 The default is the hostname associated with the IP address that
167 .Nm
168 is listening on.
169 This ability (with or without
170 .Fl h ) ,
171 in conjunction with
172 .Fl c Ar confdir ,
173 is useful when configuring
174 .Sq virtual
175 .Tn FTP
176 servers, each listening on separate addresses as separate names.
177 Refer to
178 .Xr inetd.conf 5
179 for more information on starting services to listen on specific IP addresses.
180 .It Fl L Ar xferlogfile
181 Log
182 .Tn wu-ftpd
183 style
184 .Sq xferlog
185 entries to
186 .Ar xferlogfile .
187 .It Fl l
188 Each successful and failed
189 .Tn FTP
190 session is logged using syslog with a facility of
191 .Dv LOG_FTP .
192 If this option is specified more than once, the retrieve (get), store (put),
193 append, delete, make directory, remove directory and rename operations and
194 their file name arguments are also logged.
195 .It Fl n
196 Don't attempt translation of IP addresses to hostnames.
197 .It Fl P Ar dataport
198 Use
199 .Ar dataport
200 as the data port, overriding the default of using the port one less
201 that the port
202 .Nm
203 is listening on.
204 .It Fl Q
205 Disable the use of pid files for keeping track of the number of logged-in
206 users per class.
207 This may reduce the load on heavily loaded
208 .Tn FTP
209 servers.
210 .It Fl q
211 Enable the use of pid files for keeping track of the number of logged-in
212 users per class.
213 This is the default.
214 .It Fl r
215 Permanently drop root privileges once the user is logged in.
216 The use of this option may result in the server using a port other
217 than the (listening-port - 1) for
218 .Sy PORT
219 style commands, which is contrary to the
220 .Cm RFC 959
221 specification, but in practice very few clients rely upon this behaviour.
222 See
223 .Sx SECURITY CONSIDERATIONS
224 below for more details.
225 .It Fl s
226 Require a secure authentication mechanism like Kerberos or S/Key to be used.
227 .It Fl U
228 Don't log each concurrent
229 .Tn FTP
230 session to
231 .Pa /var/run/utmp .
232 This is the default.
233 .It Fl u
234 Log each concurrent
235 .Tn FTP
236 session to
237 .Pa /var/run/utmp ,
238 making them visible to commands such as
239 .Xr who 1 .
240 .It Fl V Ar version
241 Use
242 .Ar version
243 as the version to advertise in the login banner and in the output of
244 .Sy STAT
245 and
246 .Sy SYST
247 instead of the default version information.
248 If
249 .Ar version
250 is empty or
251 .Sq -
252 then don't display any version information.
253 .It Fl W
254 Don't log each
255 .Tn FTP
256 session to
257 .Pa /var/log/wtmp .
258 .It Fl w
259 Log each
260 .Tn FTP
261 session to
262 .Pa /var/log/wtmp ,
263 making them visible to commands such as
264 .Xr last 1 .
265 This is the default.
266 .It Fl X
267 Log
268 .Tn wu-ftpd
269 style
270 .Sq xferlog
271 entries to the syslog, prefixed with
272 .Dq "xferlog:\ " ,
273 using a facility of
274 .Dv LOG_FTP .
275 These syslog entries can be converted to a
276 .Tn wu-ftpd
277 style
278 .Pa xferlog
279 file suitable for input into a third-party log analysis tool with a command
280 similar to:
281 .Dl "sed -ne 's/^.*xferlog: //p' /var/log/xferlog \*[Gt] wuxferlog"
282 .El
283 .Pp
284 The file
285 .Pa /etc/nologin
286 can be used to disable
287 .Tn FTP
288 access.
289 If the file exists,
290 .Nm
291 displays it and exits.
292 If the file
293 .Pa /etc/ftpwelcome
294 exists,
295 .Nm
296 prints it before issuing the
297 .Dq ready
298 message.
299 If the file
300 .Pa /etc/motd
301 exists (under the chroot directory if applicable),
302 .Nm
303 prints it after a successful login.
304 This may be changed with the
305 .Xr ftpd.conf 5
306 directive
307 .Sy motd .
308 .Pp
309 The
310 .Nm
311 server currently supports the following
312 .Tn FTP
313 requests.
314 The case of the requests is ignored.
315 .Bl -column "Request" "Description" -offset indent
316 .It Sy Request Ta Sy Description
317 .It ABOR Ta "abort previous command"
318 .It ACCT Ta "specify account (ignored)"
319 .It ALLO Ta "allocate storage (vacuously)"
320 .It APPE Ta "append to a file"
321 .It CDUP Ta "change to parent of current working directory"
322 .It CWD Ta "change working directory"
323 .It DELE Ta "delete a file"
324 .It EPSV Ta "prepare for server-to-server transfer"
325 .It EPRT Ta "specify data connection port"
326 .It FEAT Ta "list extra features that are not defined in" Cm "RFC 959"
327 .It HELP Ta "give help information"
328 .It LIST Ta "give list files in a directory" Pq Dq Li "ls -lA"
329 .It LPSV Ta "prepare for server-to-server transfer"
330 .It LPRT Ta "specify data connection port"
331 .It MLSD Ta "list contents of directory in a machine-processable form"
332 .It MLST Ta "show a pathname in a machine-processable form"
333 .It MKD Ta "make a directory"
334 .It MDTM Ta "show last modification time of file"
335 .It MODE Ta "specify data transfer" Em mode
336 .It NLST Ta "give name list of files in directory"
337 .It NOOP Ta "do nothing"
338 .It OPTS Ta "define persistent options for a given command"
339 .It PASS Ta "specify password"
340 .It PASV Ta "prepare for server-to-server transfer"
341 .It PORT Ta "specify data connection port"
342 .It PWD Ta "print the current working directory"
343 .It QUIT Ta "terminate session"
344 .It REST Ta "restart incomplete transfer"
345 .It RETR Ta "retrieve a file"
346 .It RMD Ta "remove a directory"
347 .It RNFR Ta "specify rename-from file name"
348 .It RNTO Ta "specify rename-to file name"
349 .It SITE Ta "non-standard commands (see next section)"
350 .It SIZE Ta "return size of file"
351 .It STAT Ta "return status of server"
352 .It STOR Ta "store a file"
353 .It STOU Ta "store a file with a unique name"
354 .It STRU Ta "specify data transfer" Em structure
355 .It SYST Ta "show operating system type of server system"
356 .It TYPE Ta "specify data transfer" Em type
357 .It USER Ta "specify user name"
358 .It XCUP Ta "change to parent of current working directory (deprecated)"
359 .It XCWD Ta "change working directory (deprecated)"
360 .It XMKD Ta "make a directory (deprecated)"
361 .It XPWD Ta "print the current working directory (deprecated)"
362 .It XRMD Ta "remove a directory (deprecated)"
363 .El
364 .Pp
365 The following non-standard or
366 .Ux
367 specific commands are supported by the SITE request.
368 .Pp
369 .Bl -column Request Description -offset indent
370 .It Sy Request Ta Sy Description
371 .It CHMOD Ta "change mode of a file, e.g. ``SITE CHMOD 755 filename''"
372 .It HELP Ta "give help information."
373 .It IDLE Ta "set idle-timer, e.g. ``SITE IDLE 60''"
374 .It RATEGET Ta "set maximum get rate throttle in bytes/second, e.g. ``SITE RATEGET 5k''"
375 .It RATEPUT Ta "set maximum put rate throttle in bytes/second, e.g. ``SITE RATEPUT 5k''"
376 .It UMASK Ta "change umask, e.g. ``SITE UMASK 002''"
377 .El
378 .Pp
379 The following
380 .Tn FTP
381 requests (as specified in
382 .Cm RFC 959
383 and
384 .Cm RFC 2228 )
385 are recognized, but are not implemented:
386 .Sy ACCT ,
387 .Sy ADAT ,
388 .Sy AUTH ,
389 .Sy CCC ,
390 .Sy CONF ,
391 .Sy ENC ,
392 .Sy MIC ,
393 .Sy PBSZ ,
394 .Sy PROT ,
395 .Sy REIN ,
396 and
397 .Sy SMNT .
398 .Pp
399 The
400 .Nm
401 server will abort an active file transfer only when the
402 .Sy ABOR
403 command is preceded by a Telnet "Interrupt Process" (IP)
404 signal and a Telnet "Synch" signal in the command Telnet stream,
405 as described in Internet
406 .Cm RFC 959 .
407 If a
408 .Sy STAT
409 command is received during a data transfer, preceded by a Telnet IP
410 and Synch, transfer status will be returned.
411 .Pp
412 .Nm
413 interprets file names according to the
414 .Dq globbing
415 conventions used by
416 .Xr csh 1 .
417 This allows users to use the metacharacters
418 .Dq Li \&*?[]{}~ .
419 .Ss User authentication
420 .Nm
421 authenticates users according to five rules.
422 .Pp
423 .Bl -enum -offset indent
424 .It
425 The login name must be in the password data base,
426 .Xr passwd 5 ,
427 and not have a null password.
428 In this case a password must be provided by the client before any
429 file operations may be performed.
430 If the user has an S/Key key, the response from a successful
431 .Sy USER
432 command will include an S/Key challenge.
433 The client may choose to respond with a
434 .Sy PASS
435 command giving either
436 a standard password or an S/Key one-time password.
437 The server will automatically determine which type of password it
438 has been given and attempt to authenticate accordingly.
439 See
440 .Xr skey 1
441 for more information on S/Key authentication.
442 S/Key is a Trademark of Bellcore.
443 .It
444 The login name must be allowed based on the information in
445 .Xr ftpusers 5 .
446 .It
447 The user must have a standard shell returned by
448 .Xr getusershell 3 .
449 If the user's shell field in the password database is empty, the
450 shell is assumed to be
451 .Pa /bin/sh .
452 As per
453 .Xr shells 5 ,
454 the user's shell must be listed with full path in
455 .Pa /etc/shells .
456 .It
457 If directed by the file
458 .Xr ftpchroot 5
459 the session's root directory will be changed by
460 .Xr chroot 2
461 to the directory specified in the
462 .Xr ftpd.conf 5
463 .Sy chroot
464 directive (if set),
465 or to the home directory of the user.
466 This facility may also be triggered by enabling the boolean
467 .Sy ftp-chroot
468 in
469 .Xr login.conf 5 .
470 However, the user must still supply a password.
471 This feature is intended as a compromise between a fully anonymous account
472 and a fully privileged account.
473 The account should also be set up as for an anonymous account.
474 .It
475 If the user name is
476 .Dq anonymous
477 or
478 .Dq ftp ,
479 an
480 anonymous
481 .Tn FTP
482 account must be present in the password
483 file (user
484 .Dq ftp ) .
485 In this case the user is allowed
486 to log in by specifying any password (by convention an email address for
487 the user should be used as the password).
488 .Pp
489 The server performs a
490 .Xr chroot 2
491 to the directory specified in the
492 .Xr ftpd.conf 5
493 .Sy chroot
494 directive (if set),
495 the
496 .Fl a Ar anondir
497 directory (if set),
498 or to the home directory of the
499 .Dq ftp
500 user.
501 .Pp
502 The server then performs a
503 .Xr chdir 2
504 to the directory specified in the
505 .Xr ftpd.conf 5
506 .Sy homedir
507 directive (if set), otherwise to
508 .Pa / .
509 .Pp
510 If other restrictions are required (such as disabling of certain
511 commands and the setting of a specific umask), then appropriate
512 entries in
513 .Xr ftpd.conf 5
514 are required.
515 .Pp
516 If the first character of the password supplied by an anonymous user
517 is
518 .Dq - ,
519 then the verbose messages displayed at login and upon a
520 .Sy CWD
521 command are suppressed.
522 .El
523 .Ss Display file escape sequences
524 When
525 .Nm
526 displays various files back to the client (such as
527 .Pa /etc/ftpwelcome
528 and
529 .Pa /etc/motd ) ,
530 various escape strings are replaced with information pertinent
531 to the current connection.
532 .Pp
533 The supported escape strings are:
534 .Bl -tag -width "Escape" -offset indent -compact
535 .It Sy "Escape"
536 .Sy Description
537 .It "\&%c"
538 Class name.
539 .It "\&%C"
540 Current working directory.
541 .It "\&%E"
542 Email address given with
543 .Fl e .
544 .It "\&%L"
545 Local hostname.
546 .It "\&%M"
547 Maximum number of users for this class.
548 Displays
549 .Dq unlimited
550 if there's no limit.
551 .It "\&%N"
552 Current number of users for this class.
553 .It "\&%R"
554 Remote hostname.
555 .It "\&%s"
556 If the result of the most recent
557 .Dq "\&%M"
558 or
559 .Dq "\&%N"
560 was not
561 .Dq Li 1 ,
562 print an
563 .Dq s .
564 .It "\&%S"
565 If the result of the most recent
566 .Dq "\&%M"
567 or
568 .Dq "\&%N"
569 was not
570 .Dq Li 1 ,
571 print an
572 .Dq S .
573 .It "\&%T"
574 Current time.
575 .It "\&%U"
576 User name.
577 .It "\&%\&%"
578 A
579 .Dq \&%
580 character.
581 .El
582 .Ss Setting up a restricted ftp subtree
583 In order that system security is not breached, it is recommended
584 that the
585 subtrees for the
586 .Dq ftp
587 and
588 .Dq chroot
589 accounts be constructed with care, following these rules
590 (replace
591 .Dq ftp
592 in the following directory names
593 with the appropriate account name for
594 .Sq chroot
595 users):
596 .Bl -tag -width "~ftp/incoming" -offset indent
597 .It Pa ~ftp
598 Make the home directory owned by
599 .Dq root
600 and unwritable by anyone.
601 .It Pa ~ftp/bin
602 Make this directory owned by
603 .Dq root
604 and unwritable by anyone (mode 555).
605 Generally any conversion commands should be installed
606 here (mode 111).
607 .It Pa ~ftp/etc
608 Make this directory owned by
609 .Dq root
610 and unwritable by anyone (mode 555).
611 The files
612 .Pa pwd.db
613 (see
614 .Xr passwd 5 )
615 and
616 .Pa group
617 (see
618 .Xr group 5 )
619 must be present for the
620 .Sy LIST
621 command to be able to display owner and group names instead of numbers.
622 The password field in
623 .Xr passwd 5
624 is not used, and should not contain real passwords.
625 The file
626 .Pa motd ,
627 if present, will be printed after a successful login.
628 These files should be mode 444.
629 .It Pa ~ftp/pub
630 This directory and the subdirectories beneath it should be owned
631 by the users and groups responsible for placing files in them,
632 and be writable only by them (mode 755 or 775).
633 They should
634 .Em not
635 be owned or writable by ftp or its group.
636 .It Pa ~ftp/incoming
637 This directory is where anonymous users place files they upload.
638 The owners should be the user
639 .Dq ftp
640 and an appropriate group.
641 Members of this group will be the only users with access to these
642 files after they have been uploaded; these should be people who
643 know how to deal with them appropriately.
644 If you wish anonymous
645 .Tn FTP
646 users to be able to see the names of the
647 files in this directory the permissions should be 770, otherwise
648 they should be 370.
649 .Pp
650 The following
651 .Xr ftpd.conf 5
652 directives should be used:
653 .Dl "modify guest off"
654 .Dl "umask guest 0707"
655 .Dl "upload guest on"
656 .Pp
657 This will result in anonymous users being able to upload files to this
658 directory, but they will not be able to download them, delete them, or
659 overwrite them, due to the umask and disabling of the commands mentioned
660 above.
661 .It Pa ~ftp/tmp
662 This directory is used to create temporary files which contain
663 the error messages generated by a conversion or
664 .Sy LIST
665 command.
666 The owner should be the user
667 .Dq ftp .
668 The permissions should be 300.
669 .Pp
670 If you don't enable conversion commands, or don't want anonymous users
671 uploading files here (see
672 .Pa ~ftp/incoming
673 above), then don't create this directory.
674 However, error messages from conversion or
675 .Sy LIST
676 commands won't be returned to the user.
677 (This is the traditional behaviour.)
678 Note that the
679 .Xr ftpd.conf 5
680 directive
681 .Sy upload
682 can be used to prevent users uploading here.
683 .El
684 .Pp
685 To set up "ftp-only" accounts that provide only
686 .Tn FTP ,
687 but no valid shell
688 login, you can copy/link
689 .Pa /sbin/nologin
690 to
691 .Pa /sbin/ftplogin ,
692 and enter
693 .Pa /sbin/ftplogin
694 to
695 .Pa /etc/shells
696 to allow logging-in via
697 .Tn FTP
698 into the accounts, which must have
699 .Pa /sbin/ftplogin
700 as login shell.
701 .Sh FILES
702 .Bl -tag -width /etc/ftpwelcome -compact
703 .It Pa /etc/ftpchroot
704 List of normal users whose root directory should be changed via
705 .Xr chroot 2 .
706 .It Pa /etc/ftpd.conf
707 Configure file conversions and other settings.
708 .It Pa /etc/ftpusers
709 List of unwelcome/restricted users.
710 .It Pa /etc/ftpwelcome
711 Welcome notice before login.
712 .It Pa /etc/motd
713 Welcome notice after login.
714 .It Pa /etc/nologin
715 If it exists, displayed and access is refused.
716 .It Pa /var/run/ftpd.pids-CLASS
717 State file of logged-in processes for the
718 .Nm
719 class
720 .Sq CLASS .
721 .It Pa /var/run/utmp
722 List of logged-in users on the system.
723 .It Pa /var/log/wtmp
724 Login history database.
725 .El
726 .Sh SEE ALSO
727 .Xr ftp 1 ,
728 .Xr skey 1 ,
729 .Xr who 1 ,
730 .Xr getusershell 3 ,
731 .Xr ftpchroot 5 ,
732 .Xr ftpd.conf 5 ,
733 .Xr ftpusers 5 ,
734 .Xr login.conf 5 ,
735 .Xr syslogd 8
736 .Sh STANDARDS
737 .Nm
738 recognizes all commands in
739 .Cm RFC 959 ,
740 follows the guidelines in
741 .Cm RFC 1123 ,
742 recognizes all commands in
743 .Cm RFC 2228
744 (although they are not supported yet),
745 and supports the extensions from
746 .Cm RFC 2389 ,
747 .Cm RFC 2428 ,
748 and
749 .Cm RFC 3659 .
750 .Sh HISTORY
751 The
752 .Nm
753 command appeared in
754 .Bx 4.2 .
755 .Pp
756 Various features such as the
757 .Xr ftpd.conf 5
758 functionality,
759 .Cm RFC 2389 ,
760 and
761 .Cm RFC 3659
762 support was implemented in
763 .Nx 1.3
764 and later releases by Luke Mewburn.
765 .Sh BUGS
766 The server must run as the super-user to create sockets with
767 privileged port numbers (i.e, those less than
768 .Dv IPPORT_RESERVED ,
769 which is 1024).
770 If
771 .Nm
772 is listening on a privileged port
773 it maintains an effective user id of the logged in user, reverting
774 to the super-user only when binding addresses to privileged sockets.
775 The
776 .Fl r
777 option can be used to override this behaviour and force privileges to
778 be permanently revoked; see
779 .Sx SECURITY CONSIDERATIONS
780 below for more details.
781 .Pp
782 .Nm
783 may have trouble handling connections from scoped IPv6 addresses, or
784 IPv4 mapped addresses
785 .Po
786 IPv4 connection on
787 .Dv AF_INET6
788 socket
789 .Pc .
790 For the latter case, running two daemons,
791 one for IPv4 and one for IPv6, will avoid the problem.
792 .Sh SECURITY CONSIDERATIONS
793 .Cm RFC 959
794 provides no restrictions on the
795 .Sy PORT
796 command, and this can lead to security problems, as
797 .Nm
798 can be fooled into connecting to any service on any host.
799 With the
800 .Dq checkportcmd
801 feature of the
802 .Xr ftpd.conf 5 ,
803 .Sy PORT
804 commands with different host addresses, or TCP ports lower than
805 .Dv IPPORT_RESERVED
806 will be rejected.
807 This also prevents
808 .Sq third-party proxy ftp
809 from working.
810 Use of this option is
811 .Em strongly
812 recommended, and enabled by default.
813 .Pp
814 By default
815 .Nm
816 uses a port that is one less than the port it is listening on to
817 communicate back to the client for the
818 .Sy EPRT ,
819 .Sy LPRT ,
820 and
821 .Sy PORT
822 commands, unless overridden with
823 .Fl P Ar dataport .
824 As the default port for
825 .Nm
826 (21) is a privileged port below
827 .Dv IPPORT_RESERVED ,
828 .Nm
829 retains the ability to switch back to root privileges to bind these
830 ports.
831 In order to increase security by reducing the potential for a bug in
832 .Nm
833 providing a remote root compromise,
834 .Nm
835 will permanently drop root privileges if one of the following is true:
836 .Bl -enum -offset indent
837 .It
838 .Nm
839 is running on a port greater than
840 .Dv IPPORT_RESERVED
841 and the user has logged in as a
842 .Sq guest
843 or
844 .Sq chroot
845 user.
846 .It
847 .Nm
848 was invoked with
849 .Fl r .
850 .El
851 .Pp
852 Don't create
853 .Pa ~ftp/tmp
854 if you don't want anonymous users to upload files there.
855 That directory is only necessary if you want to display the error
856 messages of conversion commands to the user.
857 Note that if uploads are disabled with the
858 .Xr ftpd.conf 5
859 directive
860 .Sy upload ,
861 then this directory cannot be abused by the user in this way, so it
862 should be safe to create.
863 .Pp
864 To avoid possible denial-of-service attacks,
865 .Sy SIZE
866 requests against files larger than 10240 bytes will be denied if
867 the current transfer
868 .Sy TYPE
869 is
870 .Sq Li A
871 (ASCII).