1.\" Copyright (c) 1985, 1988, 1991, 1993 2.\" The Regents of the University of California. All rights reserved. 3.\" 4.\" %sccs.include.redist.man% 5.\" 6.\" @(#)ftpd.8 8.3 (Berkeley) 06/01/94 7.\" 8.Dd 9.Dt FTPD 8 10.Os BSD 4.2 11.Sh NAME 12.Nm ftpd 13.Nd 14Internet File Transfer Protocol server 15.Sh SYNOPSIS 16.Nm ftpd 17.Op Fl dl 18.Op Fl T Ar maxtimeout 19.Op Fl t Ar timeout 20.Sh DESCRIPTION 21.Nm Ftpd 22is the 23Internet File Transfer Protocol 24server process. The server uses the 25.Tn TCP 26protocol 27and listens at the port specified in the 28.Dq ftp 29service specification; see 30.Xr services 5 . 31.Pp 32Available options: 33.Bl -tag -width Ds 34.It Fl d 35Debugging information is written to the syslog using LOG_FTP. 36.It Fl l 37Each successful and failed 38.Xr ftp 1 39session is logged using syslog with a facility of LOG_FTP. 40If this option is specified twice, the retrieve (get), store (put), append, 41delete, make directory, remove directory and rename operations and 42their filename arguments are also logged. 43.It Fl T 44A client may also request a different timeout period; 45the maximum period allowed may be set to 46.Ar timeout 47seconds with the 48.Fl T 49option. 50The default limit is 2 hours. 51.It Fl t 52The inactivity timeout period is set to 53.Ar timeout 54seconds (the default is 15 minutes). 55.El 56.Pp 57The file 58.Pa /etc/nologin 59can be used to disable ftp access. 60If the file exists, 61.Nm 62displays it and exits. 63If the file 64.Pa /etc/ftpwelcome 65exists, 66.Nm 67prints it before issuing the 68.Dq ready 69message. 70If the file 71.Pa /etc/motd 72exists, 73.Nm 74prints it after a successful login. 75.Pp 76The ftp server currently supports the following ftp requests. 77The case of the requests is ignored. 78.Bl -column "Request" -offset indent 79.It Request Ta "Description" 80.It ABOR Ta "abort previous command" 81.It ACCT Ta "specify account (ignored)" 82.It ALLO Ta "allocate storage (vacuously)" 83.It APPE Ta "append to a file" 84.It CDUP Ta "change to parent of current working directory" 85.It CWD Ta "change working directory" 86.It DELE Ta "delete a file" 87.It HELP Ta "give help information" 88.It LIST Ta "give list files in a directory" Pq Dq Li "ls -lgA" 89.It MKD Ta "make a directory" 90.It MDTM Ta "show last modification time of file" 91.It MODE Ta "specify data transfer" Em mode 92.It NLST Ta "give name list of files in directory" 93.It NOOP Ta "do nothing" 94.It PASS Ta "specify password" 95.It PASV Ta "prepare for server-to-server transfer" 96.It PORT Ta "specify data connection port" 97.It PWD Ta "print the current working directory" 98.It QUIT Ta "terminate session" 99.It REST Ta "restart incomplete transfer" 100.It RETR Ta "retrieve a file" 101.It RMD Ta "remove a directory" 102.It RNFR Ta "specify rename-from file name" 103.It RNTO Ta "specify rename-to file name" 104.It SITE Ta "non-standard commands (see next section)" 105.It SIZE Ta "return size of file" 106.It STAT Ta "return status of server" 107.It STOR Ta "store a file" 108.It STOU Ta "store a file with a unique name" 109.It STRU Ta "specify data transfer" Em structure 110.It SYST Ta "show operating system type of server system" 111.It TYPE Ta "specify data transfer" Em type 112.It USER Ta "specify user name" 113.It XCUP Ta "change to parent of current working directory (deprecated)" 114.It XCWD Ta "change working directory (deprecated)" 115.It XMKD Ta "make a directory (deprecated)" 116.It XPWD Ta "print the current working directory (deprecated)" 117.It XRMD Ta "remove a directory (deprecated)" 118.El 119.Pp 120The following non-standard or 121.Tn UNIX 122specific commands are supported 123by the 124SITE request. 125.Pp 126.Bl -column Request -offset indent 127.It Sy Request Ta Sy Description 128.It UMASK Ta change umask, e.g. ``SITE UMASK 002'' 129.It IDLE Ta set idle-timer, e.g. ``SITE IDLE 60'' 130.It CHMOD Ta change mode of a file, e.g. ``SITE CHMOD 755 filename'' 131.It HELP Ta give help information. 132.El 133.Pp 134The remaining ftp requests specified in Internet RFC 959 135are 136recognized, but not implemented. 137MDTM and SIZE are not specified in RFC 959, but will appear in the 138next updated FTP RFC. 139.Pp 140The ftp server will abort an active file transfer only when the 141ABOR 142command is preceded by a Telnet "Interrupt Process" (IP) 143signal and a Telnet "Synch" signal in the command Telnet stream, 144as described in Internet RFC 959. 145If a 146STAT 147command is received during a data transfer, preceded by a Telnet IP 148and Synch, transfer status will be returned. 149.Pp 150.Nm Ftpd 151interprets file names according to the 152.Dq globbing 153conventions used by 154.Xr csh 1 . 155This allows users to utilize the metacharacters 156.Dq Li \&*?[]{}~ . 157.Pp 158.Nm Ftpd 159authenticates users according to three rules. 160.Pp 161.Bl -enum -offset indent 162.It 163The login name must be in the password data base, 164.Pa /etc/passwd , 165and not have a null password. 166In this case a password must be provided by the client before any 167file operations may be performed. 168.It 169The login name must not appear in the file 170.Pa /etc/ftpusers . 171.It 172The user must have a standard shell returned by 173.Xr getusershell 3 . 174.It 175If the user name is 176.Dq anonymous 177or 178.Dq ftp , 179an 180anonymous ftp account must be present in the password 181file (user 182.Dq ftp ) . 183In this case the user is allowed 184to log in by specifying any password (by convention an email address for 185the user should be used as the password). 186.El 187.Pp 188In the last case, 189.Nm ftpd 190takes special measures to restrict the client's access privileges. 191The server performs a 192.Xr chroot 2 193to the home directory of the 194.Dq ftp 195user. 196In order that system security is not breached, it is recommended 197that the 198.Dq ftp 199subtree be constructed with care, following these rules: 200.Bl -tag -width "~ftp/pub" -offset indent 201.It Pa ~ftp 202Make the home directory owned by 203.Dq root 204and unwritable by anyone. 205.ne 1i 206.It Pa ~ftp/bin 207Make this directory owned by 208.Dq root 209and unwritable by anyone (mode 555). 210The program 211.Xr ls 1 212must be present to support the list command. 213This program should be mode 111. 214.It Pa ~ftp/etc 215Make this directory owned by 216.Dq root 217and unwritable by anyone (mode 555). 218The files 219.Xr passwd 5 220and 221.Xr group 5 222must be present for the 223.Xr ls 224command to be able to produce owner names rather than numbers. 225The password field in 226.Xr passwd 227is not used, and should not contain real passwords. 228The file 229.Pa motd , 230if present, will be printed after a successful login. 231These files should be mode 444. 232.It Pa ~ftp/pub 233Make this directory mode 777 and owned by 234.Dq ftp . 235Guests 236can then place files which are to be accessible via the anonymous 237account in this directory. 238.El 239.Sh FILES 240.Bl -tag -width /etc/ftpwelcome -compact 241.It Pa /etc/ftpusers 242List of unwelcome/restricted users. 243.It Pa /etc/ftpwelcome 244Welcome notice. 245.It Pa /etc/motd 246Welcome notice after login. 247.It Pa /etc/nologin 248Displayed and access refused. 249.El 250.Sh SEE ALSO 251.Xr ftp 1 , 252.Xr getusershell 3 , 253.Xr syslogd 8 254.Sh BUGS 255The server must run as the super-user 256to create sockets with privileged port numbers. It maintains 257an effective user id of the logged in user, reverting to 258the super-user only when binding addresses to sockets. The 259possible security holes have been extensively 260scrutinized, but are possibly incomplete. 261.Sh HISTORY 262The 263.Nm 264command appeared in 265.Bx 4.2 . 266