 以 PDF 格式下载本书 (9905 KB)
in.ftpd(1M)Name | Synopsis | Description | Options | Security | Usage | Files | Attributes | See Also | Diagnostics | Notes Name
Synopsis
in.ftpd [-4] [-A] [-a] [-C] [-d] [-I] [-i] [-K] [-L] [-l]
[-o] [-P dataport] [-p ctrlport] [-Q] [-q]
[-r rootdir] [-S] [-s] [-T maxtimeout] [-t timeout]
[-u umask] [-V] [-v] [-W] [-w] [-X]
Descriptionin.ftpd is the Internet File Transfer Protocol (FTP) server process. The server may be invoked by the Internet daemon inetd(1M) each time a connection to the FTP service is made or run as a standalone server. See services(4). Options
in.ftpd supports the following options: RequestsThe FTP Server currently supports the following FTP requests. Case is not distinguished. The following nonstandard or UNIX specific commands are supported by the SITE request: The remaining FTP requests specified in RFC 959 are recognized, but not implemented. The FTP server will abort an active file transfer only when the ABOR command is preceded by a Telnet “Interrupt Process” (IP) signal and a Telnet “Synch” signal in the command Telnet stream, as described in RFC 959. If a STAT command is received during a data transfer that has been preceded by a Telnet IP and Synch, transfer status will be returned. in.ftpd interprets file names according to the “globbing” conventions used by csh(1). This allows users to utilize the metacharacters: * ? [ ] { } ~ in.ftpd authenticates users according to the following rules: First, the user name must be in the password data base, the location of which is specified in nsswitch.conf(4). An encrypted password (an authentication token in PAM) must be present. A password must always be provided by the client before any file operations can be performed. For non-anonymous users, the PAM framework is used to verify that the correct password was entered. See SECURITY below. Second, the user name must not appear in either the /etc/ftpusers or the /etc/ftpd/ftpusers file. Use of the /etc/ftpusers files is deprecated, although it is still supported. Third, the users must have a standard shell returned by getusershell(3C). Fourth, if the user name is anonymous or ftp, an anonymous ftp account must be present in the password file for user ftp. Use ftpconfig(1M) to create the anonymous ftp account and home directory tree. Fifth, if the GSS-API is used to authenticate the user, then gss_auth_rules(5) determines user access without a password needed. The FTP Server supports virtual hosting, which can be configured by using ftpaddhost(1M). The FTP Server does not support sublogins. General FTP ExtensionsThe FTP Server has certain extensions. If the user specifies a filename that does not exist with a RETR (retrieve) command, the FTP Server looks for a conversion to change a file or directory that does into the one requested. See ftpconversions(4). By convention, anonymous users supply their email address when prompted for a password. The FTP Server attempts to validate these email addresses. A user whose FTP client hangs on a long reply, for example, a multiline response, should use a dash (-) as the first character of the user's password, as this disables the Server's lreply() function. The FTP Server can also log all file transmission and reception. See xferlog(4) for details of the log file format. The SITE EXEC command may be used to execute commands in the /bin/ftp-exec directory. Take care that you understand the security implications before copying any command into the /bin/ftp-exec directory. For example, do not copy in /bin/sh. This would enable the user to execute other commands through the use of sh -c. If you have doubts about this feature, do not create the /bin/ftp-exec directory. SecurityFor non-anonymous users, in.ftpd uses pam(3PAM) for authentication, account management, and session management, and can use Kerberos v5 for authentication. The PAM configuration policy, listed through /etc/pam.conf, specifies the module to be used for in.ftpd. Here is a partial pam.conf file with entries for the in.ftpd command using the UNIX authentication, account management, and session management module. ftp auth requisite pam_authtok_get.so.1 ftp auth required pam_dhkeys.so.1 ftp auth required pam_unix_auth.so.1 ftp account required pam_unix_roles.so.1 ftp account required pam_unix_projects.so.1 ftp account required pam_unix_account.so.1 ftp session required pam_unix_session.so.1 If there are no entries for the ftp service, then the entries for the “other” service will be used. Unlike login, passwd, and other commands, the ftp protocol will only support a single password. Using multiple modules will prevent in.ftpd from working properly. To use Kerberos for authentication, a host/<FQDN> Kerberos principal must exist for each Fully Qualified Domain Name associated with the in.ftpd server. Each of these host/<FQDN> principals must have a keytab entry in the /etc/krb5/krb5.keytab file on the in.ftpd server. An example principal might be: host/bigmachine.eng.example.com See kadmin(1M) or gkadmin(1M) for instructions on adding a principal to a krb5.keytab file. See System Administration Guide: Security Services for a discussion of Kerberos authentication. For anonymous users, who by convention supply their email address as a password, in.ftpd validates passwords according to the passwd-check capability in the ftpaccess file. UsageThe in.ftpd command is IPv6–enabled. See ip6(7P). Files
AttributesSee attributes(5) for descriptions of the following attributes:
See Alsocsh(1), ftp(1), ftpcount(1), ftpwho(1), ls(1), svcs(1), ftpaddhost(1M), ftpconfig(1M), ftprestart(1M), ftpshut(1M), gkadmin(1M), inetadm(1M), inetd(1M), kadmin(1M), svcadm(1M), syslogd(1M), chroot(2), umask(2), getpwent(3C), getusershell(3C), syslog(3C), ftpaccess(4), ftpconversions(4), ftpgroups(4), ftphosts(4), ftpservers(4), ftpusers(4), group(4), passwd(4), services(4), xferlog(4), wtmpx(4), attributes(5), gss_auth_rules(5), pam_authtok_check(5), pam_authtok_get(5), pam_authtok_store(5), pam_dhkeys(5), pam_passwd_auth(5), pam_unix_account(5), pam_unix_auth(5), pam_unix_session(5), smf(5), ip6(7P) System Administration Guide: Security Services Allman, M., Ostermann, S., and Metz, C. RFC 2428, FTP Extensions for IPv6 and NATs. The Internet Society. September 1998. Piscitello, D. RFC 1639, FTP Operation Over Big Address Records (FOOBAR). Network Working Group. June 1994. Postel, Jon, and Joyce Reynolds. RFC 959, File Transfer Protocol (FTP ). Network Information Center. October 1985. St. Johns, Mike. RFC 931, Authentication Server. Network Working Group. January 1985. Linn, J., Generic Security Service Application Program Interface Version 2, Update 1, RFC 2743. The Internet Society, January 2000. Horowitz, M., Lunt, S., FTP Security Extensions, RFC 2228. The Internet Society, October 1997. Diagnosticsin.ftpd logs various errors to syslogd(1M), with a facility code of daemon. NotesThe anonymous FTP account is inherently dangerous and should be avoided when possible. The FTP Server must perform certain tasks as the superuser, for example, the creation of sockets with privileged port numbers. It maintains an effective user ID of the logged in user, reverting to the superuser only when necessary. The FTP Server no longer supports the /etc/default/ftpd file. Instead of using UMASK=nnn to set the umask, use the defumask capability in the ftpaccess file. The banner greeting text capability is also now set through the ftpaccess file by using the greeting text capability instead of by using BANNER="...". However, unlike the BANNER string, the greeting text string is not passed to the shell for evaluation. See ftpaccess(4). The pam_unix(5) module is no longer supported. Similar functionality is provided by pam_authtok_check(5), pam_authtok_get(5), pam_authtok_store(5), pam_dhkeys(5), pam_passwd_auth(5), pam_unix_account(5), pam_unix_auth(5), and pam_unix_session(5). The in.ftpd service is managed by the service management facility, smf(5), under the service identifier:
Administrative actions on this service, such as enabling, disabling, or requesting restart, can be performed using svcadm(1M). Responsibility for initiating and restarting this service is delegated to inetd(1M). Use inetadm(1M) to make configuration changes and to view configuration information for this service. The service's status can be queried using the svcs(1) command. Name | Synopsis | Description | Options | Security | Usage | Files | Attributes | See Also | Diagnostics | Notes |
||||||||
|