|FTPD(8)||System Manager's Manual||FTPD(8)|
ftpd — Internet
File Transfer Protocol server
ftpd is the Internet File Transfer
Protocol server process. The server uses the TCP protocol and listens at the
port specified in the “ftp” service specification; see
The options are as follows:
-Dis specified, forces
ftpdto use IPv4 addresses only.
-Dis specified, forces
ftpdto use IPv6 addresses only.
-noption is specified), accounts listed in /etc/ftpchroot or users in a login class with the “ftp-chroot” variable set (see below). Other connection attempts are refused.
ftpdwill detach and become a daemon, accepting connections on the FTP port and forking child processes to handle them. This has lower overhead than starting
ftpdfrom inetd(8) and is thus useful on busy servers to reduce load.
LOG_FTP. If this option is specified twice, the retrieve (get), store (put), append, delete, make directory, remove directory and rename operations and their filename arguments are also logged.
ftpdviolates the RFC and thus constrains the PORT command to non-reserved ports and requires it use the same source address as the connection came from. This prevents the "FTP bounce attack" against services on both the local machine and other local machines.
ftpdlogs all anonymous downloads to the file /var/log/ftpd when this file exists.
-Toption. The default limit is 2 hours.
-Ware mutually exclusive.
-Uare mutually exclusive.
The file /etc/nologin can be used
to disable FTP access. If the file exists,
displays it and exits. Note: this method will disable
all non-root logins;
see login(1) for further
details. If the file /etc/ftpwelcome exists,
ftpd prints it before issuing the
“ready” message. If the welcome file exists
(/etc/motd by default),
prints it after a successful login. If the file
.message exists in a directory,
ftpd prints it when that directory is entered.
The FTP server currently supports the following FTP requests. The case of the requests is ignored.
|ABOR||abort previous command|
|ACCT||specify account (not implemented)|
|ALLO||allocate storage (vacuously)|
|APPE||append to a file|
|CDUP||change to parent of current working directory|
|CWD||change working directory|
|DELE||delete a file|
|EPRT||specify data connection port|
|EPSV||prepare for server-to-server transfer|
|HELP||give help information|
|LIST||give list of files in a directory (
|LPRT||specify data connection port|
|LPSV||prepare for server-to-server transfer|
|MDTM||show last modification time of file|
|MKD||make a directory|
|MODE||specify data transfer mode|
|NLST||give name list of files in directory|
|PASV||prepare for server-to-server transfer|
|PORT||specify data connection port|
|PWD||print the current working directory|
|REIN||reinitialize (not implemented)|
|REST||restart incomplete transfer|
|RETR||retrieve a file|
|RMD||remove a directory|
|RNFR||specify rename-from file name|
|RNTO||specify rename-to file name|
|SITE||non-standard commands (see next section)|
|SIZE||return size of file|
|SMNT||structure mount (not implemented)|
|STAT||return status of server|
|STOR||store a file|
|STOU||store a file with a unique name|
|STRU||specify data transfer structure|
|SYST||show operating system type of server system|
|TYPE||specify data transfer type|
|USER||specify user name; not valid after login|
|XCUP||change to parent of current working directory (deprec.)|
|XCWD||change working directory (deprecated)|
|XMKD||make a directory (deprecated)|
|XPWD||print the current working directory (deprecated)|
|XRMD||remove a directory (deprecated)|
The following non-standard or UNIX specific commands are supported by the SITE request:
|CHMOD||change mode of a file, e.g., SITE CHMOD 755 filename|
|HELP||give help information|
|IDLE||set idle-timer, e.g., SITE IDLE 60|
|UMASK||change umask, e.g., SITE UMASK 002|
The remaining FTP requests specified in Internet RFC 959 are recognized, but not implemented. MDTM and SIZE are not specified in RFC 959, but will appear in the next updated FTP RFC.
The FTP server will abort an active file transfer only when the ABOR command is preceded by a Telnet "Interrupt Process" (IP) signal and a Telnet "Synch" signal in the command Telnet stream, as described in Internet RFC 959. If a STAT command is received during a data transfer, preceded by a Telnet IP and Synch, transfer status will be returned.
ftpd interprets file names according to
the “globbing” conventions used by
csh(1). This allows users to
utilize the metacharacters
ftpd authenticates users by using the
service and type of ftp, as defined in the
/etc/login.conf file (see
authentication style may be specified by appending with a colon
(‘:’) following the authentication style, i.e.
“joe:skey”. The allowed authentication styles for
ftpd may be explicitly specified by the
“auth-ftp” entry in
ftpd authenticates users according to five
Once a user is authenticated the user must be approved by any
approval script defined (see
login.conf(5)). If a
valid approval script (by either :approve=...: or :approve-ftp=...: for the
user's class) is defined then it is run and must exit with a 0 (success)
ftpd is running under the
-D flag (and debugging is not turned on) then the
approval script will be called with at least the following variables
specified via the
-v option (see
login.conf(5)) to the
|FTPD_HOST||The server's (virtual) hostname|
For example (the line is broken to fit the page):
/usr/libexec/auth/approve_ftpd -v FTPD_HOST=ftp.mycompany.com \ username class service
When the user logs in to the anonymous FTP account,
ftpd takes special measures to restrict the client's
access privileges. The server performs a
chroot(2) to the home
directory of the “ftp” user. In order that system security is
not breached, it is recommended that the “ftp” subtree be
constructed with care, following these rules:
If logging to the /var/log/ftpd file is enabled, information will be written in the following format:
Although fields exist for logging information on real users, this
file is only used for anonymous downloads. Unused fields exist only for
compatibility with other
ftpd daemon uses the following
~’) in ftp-dir will be expanded to the user's home directory based on the contents of the password database.
For passive mode data connections,
will listen to a random high TCP port. The interval of ports used are
configurable using sysctl(8)
variables net.inet.ip.porthifirst and
ftpd command appeared in
|December 15, 2011||OpenBSD-5.1|