1.\" Copyright (c) 1985, 1988, 1991, 1993 2.\" The Regents of the University of California. All rights reserved. 3.\" 4.\" Redistribution and use in source and binary forms, with or without 5.\" modification, are permitted provided that the following conditions 6.\" are met: 7.\" 1. Redistributions of source code must retain the above copyright 8.\" notice, this list of conditions and the following disclaimer. 9.\" 2. Redistributions in binary form must reproduce the above copyright 10.\" notice, this list of conditions and the following disclaimer in the 11.\" documentation and/or other materials provided with the distribution. 12.\" 3. All advertising materials mentioning features or use of this software 13.\" must display the following acknowledgement: 14.\" This product includes software developed by the University of 15.\" California, Berkeley and its contributors. 16.\" 4. Neither the name of the University nor the names of its contributors 17.\" may be used to endorse or promote products derived from this software 18.\" without specific prior written permission. 19.\" 20.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 21.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 22.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 23.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 24.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 25.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 26.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 27.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 28.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 29.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 30.\" SUCH DAMAGE. 31.\" 32.\" @(#)ftpd.8 8.2 (Berkeley) 4/19/94 33.\" 34.Dd April 19, 1994 35.Dt FTPD 8 36.Os BSD 4.2 37.Sh NAME 38.Nm ftpd 39.Nd 40Internet File Transfer Protocol server 41.Sh SYNOPSIS 42.Nm ftpd 43.Op Fl dl 44.Op Fl S 45.Op Fl U 46.Op Fl T Ar maxtimeout 47.Op Fl t Ar timeout 48.Sh DESCRIPTION 49.Nm Ftpd 50is the 51Internet File Transfer Protocol 52server process. The server uses the 53.Tn TCP 54protocol 55and listens at the port specified in the 56.Dq ftp 57service specification; see 58.Xr services 5 . 59.Pp 60Available options: 61.Bl -tag -width Ds 62.It Fl d 63Debugging information is written to the syslog using LOG_FTP. 64.It Fl l 65Each successful and failed 66.Xr ftp 1 67session is logged using syslog with a facility of LOG_FTP. 68If this option is specified twice, the retrieve (get), store (put), append, 69delete, make directory, remove directory and rename operations and 70their filename arguments are also logged. 71.It Fl S 72With this option set, 73.Nm ftpd 74logs all anonymous transfers to the file 75.Pa /var/log/ftpd 76when this file exists. 77. 78.It Fl U 79In previous versions of 80.Nm ftpd , 81when a passive mode client requested a data connection to the server, 82the server would use data ports in the range 1024..4999. Now, by default, 83the server will use data ports in the range 40000..44999. Specifying this 84option will revert to the old behavior. 85.It Fl T 86A client may also request a different timeout period; 87the maximum period allowed may be set to 88.Ar timeout 89seconds with the 90.Fl T 91option. 92The default limit is 2 hours. 93.It Fl t 94The inactivity timeout period is set to 95.Ar timeout 96seconds (the default is 15 minutes). 97.El 98.Pp 99The file 100.Pa /etc/nologin 101can be used to disable ftp access. 102If the file exists, 103.Nm 104displays it and exits. 105If the file 106.Pa /etc/ftpwelcome 107exists, 108.Nm 109prints it before issuing the 110.Dq ready 111message. 112If the file 113.Pa /etc/ftpmotd 114exists, 115.Nm 116prints it after a successful login. 117.Pp 118The ftp server currently supports the following ftp requests. 119The case of the requests is ignored. 120.Bl -column "Request" -offset indent 121.It Request Ta "Description" 122.It ABOR Ta "abort previous command" 123.It ACCT Ta "specify account (ignored)" 124.It ALLO Ta "allocate storage (vacuously)" 125.It APPE Ta "append to a file" 126.It CDUP Ta "change to parent of current working directory" 127.It CWD Ta "change working directory" 128.It DELE Ta "delete a file" 129.It HELP Ta "give help information" 130.It LIST Ta "give list files in a directory" Pq Dq Li "ls -lgA" 131.It MKD Ta "make a directory" 132.It MDTM Ta "show last modification time of file" 133.It MODE Ta "specify data transfer" Em mode 134.It NLST Ta "give name list of files in directory" 135.It NOOP Ta "do nothing" 136.It PASS Ta "specify password" 137.It PASV Ta "prepare for server-to-server transfer" 138.It PORT Ta "specify data connection port" 139.It PWD Ta "print the current working directory" 140.It QUIT Ta "terminate session" 141.It REST Ta "restart incomplete transfer" 142.It RETR Ta "retrieve a file" 143.It RMD Ta "remove a directory" 144.It RNFR Ta "specify rename-from file name" 145.It RNTO Ta "specify rename-to file name" 146.It SITE Ta "non-standard commands (see next section)" 147.It SIZE Ta "return size of file" 148.It STAT Ta "return status of server" 149.It STOR Ta "store a file" 150.It STOU Ta "store a file with a unique name" 151.It STRU Ta "specify data transfer" Em structure 152.It SYST Ta "show operating system type of server system" 153.It TYPE Ta "specify data transfer" Em type 154.It USER Ta "specify user name" 155.It XCUP Ta "change to parent of current working directory (deprecated)" 156.It XCWD Ta "change working directory (deprecated)" 157.It XMKD Ta "make a directory (deprecated)" 158.It XPWD Ta "print the current working directory (deprecated)" 159.It XRMD Ta "remove a directory (deprecated)" 160.El 161.Pp 162The following non-standard or 163.Tn UNIX 164specific commands are supported 165by the 166SITE request. 167.Pp 168.Bl -column Request -offset indent 169.It Sy Request Ta Sy Description 170.It UMASK Ta change umask, e.g. ``SITE UMASK 002'' 171.It IDLE Ta set idle-timer, e.g. ``SITE IDLE 60'' 172.It CHMOD Ta change mode of a file, e.g. ``SITE CHMOD 755 filename'' 173.It HELP Ta give help information. 174.El 175.Pp 176The remaining ftp requests specified in Internet RFC 959 177are 178recognized, but not implemented. 179MDTM and SIZE are not specified in RFC 959, but will appear in the 180next updated FTP RFC. 181.Pp 182The ftp server will abort an active file transfer only when the 183ABOR 184command is preceded by a Telnet "Interrupt Process" (IP) 185signal and a Telnet "Synch" signal in the command Telnet stream, 186as described in Internet RFC 959. 187If a 188STAT 189command is received during a data transfer, preceded by a Telnet IP 190and Synch, transfer status will be returned. 191.Pp 192.Nm Ftpd 193interprets file names according to the 194.Dq globbing 195conventions used by 196.Xr csh 1 . 197This allows users to utilize the metacharacters 198.Dq Li \&*?[]{}~ . 199.Pp 200.Nm Ftpd 201authenticates users according to three rules. 202.Pp 203.Bl -enum -offset indent 204.It 205The login name must be in the password data base, 206.Pa /etc/passwd , 207and not have a null password. 208In this case a password must be provided by the client before any 209file operations may be performed. 210.It 211The login name must not appear in the file 212.Pa /etc/ftpusers . 213.It 214The user must have a standard shell returned by 215.Xr getusershell 3 . 216.It 217If the user name is 218.Dq anonymous 219or 220.Dq ftp , 221an 222anonymous ftp account must be present in the password 223file (user 224.Dq ftp ) . 225In this case the user is allowed 226to log in by specifying any password (by convention an email address for 227the user should be used as the password). When the 228.Fl S 229option is set, all transfers are logged as well. 230.El 231.Pp 232In the last case, 233.Nm ftpd 234takes special measures to restrict the client's access privileges. 235The server performs a 236.Xr chroot 2 237to the home directory of the 238.Dq ftp 239user. 240In order that system security is not breached, it is recommended 241that the 242.Dq ftp 243subtree be constructed with care, following these rules: 244.Bl -tag -width "~ftp/pub" -offset indent 245.It Pa ~ftp 246Make the home directory owned by 247.Dq root 248and unwritable by anyone. 249.It Pa ~ftp/bin 250Make this directory owned by 251.Dq root 252and unwritable by anyone (mode 555). 253The program 254.Xr ls 1 255must be present to support the list command. 256This program should be mode 111. 257.It Pa ~ftp/etc 258Make this directory owned by 259.Dq root 260and unwritable by anyone (mode 555). 261The files 262.Xr passwd 5 263and 264.Xr group 5 265must be present for the 266.Xr ls 267command to be able to produce owner names rather than numbers. 268The password field in 269.Xr passwd 270is not used, and should not contain real passwords. 271The file 272.Pa ftpmotd , 273if present, will be printed after a successful login. 274These files should be mode 444. 275.It Pa ~ftp/pub 276Make this directory mode 777 and owned by 277.Dq ftp . 278Guests 279can then place files which are to be accessible via the anonymous 280account in this directory. 281.El 282.Sh FILES 283.Bl -tag -width /etc/ftpwelcome -compact 284.It Pa /etc/ftpusers 285List of unwelcome/restricted users. 286.It Pa /etc/ftpwelcome 287Welcome notice. 288.It Pa /etc/ftpmotd 289Welcome notice after login. 290.It Pa /etc/nologin 291Displayed and access refused. 292.It Pa /var/log/ftpd 293Log file for anonymous transfers. 294.El 295.Sh SEE ALSO 296.Xr ftp 1 , 297.Xr getusershell 3 , 298.Xr syslogd 8 299.Sh BUGS 300The server must run as the super-user 301to create sockets with privileged port numbers. It maintains 302an effective user id of the logged in user, reverting to 303the super-user only when binding addresses to sockets. The 304possible security holes have been extensively 305scrutinized, but are possibly incomplete. 306.Sh HISTORY 307The 308.Nm 309command appeared in 310.Bx 4.2 . 311