in.ftpd is the Internet File Transfer Protocol (FTP) server process. The server may be invoked by the Internet daemon inetd(1M) each time a connection to the FTP service is made or run as a standalone server. See services(4).

in.ftpd supports the following options:

-4

When running in standalone mode, listen for connections on an AF_INET type socket. The default is to listen on an AF_INET6 type socket.

-a

Enables use of the ftpaccess(4) file.

-A

Disables use of the ftpaccess(4) file. Use of ftpaccess is disabled by default.

-C

Non-anonymous users need local credentials (for example, to authenticate to remote fileservers). So they should be prompted for a password unless they forwarded credentials as part of authentication.

-d

Writes debugging information to syslogd(1M).

-i

Logs the names of all files received by the FTP Server to xferlog(4). You can override the -i option through use of the ftpaccess(4) file.

-I

Disables the use of AUTH and ident to determine the username on the client. See RFC 931. The FTP Server is built not to use AUTH and ident.

-K

Connections are only allowed for users who can authenticate through the ftp AUTH mechanism. (Anonymous ftp may also be allowed if it is configured.) ftpd will ask the user for a password if one is required.

-l

Logs each FTP session to syslogd(1M).

-L

Logs all commands sent to in.ftpd to syslogd(1M). When the -L option is used, command logging will be on by default, once the FTP Server is invoked. Because the FTP Server includes USER commands in those logged, if a user accidentally enters a password instead of the username, the password will be logged. You can override the -L option through use of the ftpaccess(4) file.

-o

Logs the names of all files transmitted by the FTP Server to xferlog(4). You can override the -o option through use of the ftpaccess(4) file.

-P dataport

The FTP Server determines the port number by looking in the services(4) file for an entry for the ftp-data service. If there is no entry, the daemon uses the port just prior to the control connection port. Use the -P option to specify the data port number.

-p ctrlport

When run in standalone mode, the FTP Server determines the control port number by looking in the services(4) file for an entry for the ftp service. Use the -p option to specify the control port number.

-Q

Disables PID files. This disables user limits. Large, busy sites that do not want to impose limits on the number of concurrent users can use this option to disable PID files.

-q

Uses PID files. The limit directive uses PID files to determine the number of current users in each access class. By default, PID files are used.

-r rootdir

chroot(2) to rootdir upon loading. Use this option to improve system security. It limits the files that can be damaged should a break in occur through the daemon. This option is similar to anonymous FTP. Additional files are needed, which vary from system to system.

-S

Places the daemon in standalone operation mode. The daemon runs in the background. This is useful for startup scripts that run during system initialization. See init.d(4).

-s

Places the daemon in standalone operation mode. The daemon runs in the foreground. This is useful when run from /etc/inittab by init(1M).

-T maxtimeout

Sets the maximum allowable timeout period to maxtimeout seconds. The default maximum timeout limit is 7200 second (two hours). You can override the -T option through use of the ftpaccess(4) file.

-t timeout

Sets the inactivity timeout period to timeout seconds. The default timeout period is 900 seconds (15 minutes). You can override the -t option through use of the ftpaccess(4) file.

-u umask

Sets the default umask to umask.

-V

Displays copyright and version information, then terminate.

-v

Writes debugging information to syslogd(1M).

-W

Does not record user login and logout in the wtmpx(4) file.

-w

Records each user login and logout in the wtmpx(4) file. By default, logins and logouts are recorded.

-X

Writes the output from the -i and -o options to the syslogd(1M) file instead of xferlog(4). This allows the collection of output from several hosts on one central loghost. You can override the -X option through use of the ftpaccess(4) file.

Requests

General FTP Extensions

in.ftpd uses PAM(3pam) for authentication, account management, and session management. The PAM configuration policy, listed through /etc/pam.conf, specifies the module to be used for in.ftpd. Here is a partial pam.conf file with entries for the in.ftpd command using the UNIX authentication, account management, and session management module.

ftp  auth        requisite   pam_authtok_get.so.1
ftp  auth        required    pam_dhkeys.so.1
ftp  auth        required    pam_unix_auth.so.1

ftp  account     required    pam_unix_roles.so.1
ftp  account     required    pam_unix_projects.so.1
ftp  account     required    pam_unix_account.so.1

ftp  session     required    pam_unix_session.so.1

If there are no entries for the ftp service, then the entries for the "other" service will be used. Unlike login, passwd, and other commands, the ftp protocol will only support a single password. Using multiple modules will prevent in.ftpd from working properly.

PAM does not support anonymous logins.

The in.ftpd command is IPv6-enabled. See ip6(7P).

/etc/ftpd/ftpaccess

FTP Server configuration file

/etc/ftpd/ftpconversions

FTP Server conversions database

/etc/ftpd/ftpgroups

FTP Server enhanced group access file

/etc/ftpd/ftphosts

FTP Server individual user host access file

/etc/ftpd/ftpservers

FTP Server virtual hosting configuration file.

/etc/ftpd/ftpusers

File listing users for whom FTP login privileges are disallowed.

/etc/ftpusers

File listing users for whom FTP login privileges are disallowed. This use of this file is deprecated.

/var/log/xferlog

FTP Server transfer log file

/var/run/ftp.pids-classname

/var/adm/wtmpx

Extended database files that contain the history of user access and accounting information for the wtmpx database.

See attributes(5) for descriptions of the following attributes:

csh(1), ftp(1), ftpcount(1), ftpwho(1), ls(1), ftpaddhost(1M), ftpconfig(1M), ftprestart(1M), ftpshut(1M), inetd(1M), syslogd(1M), chroot(2), umask(2), getpwent(3C), getusershell(3C), syslog(3C), ftpaccess(4), ftpconversions(4), ftpgroups(4), ftphosts(4), ftpservers(4), ftpusers(4), group(4), passwd(4), services(4), xferlog(4), wtmpx(4), attributes(5), pam_authtok_check(5), pam_authtok_get(5), pam_authtok_store(5), pam_dhkeys(5), pam_passwd_auth(5), pam_unix_account(5), pam_unix_auth(5), pam_unix_session(5), ip6(7P)

Allman, M., Ostermann, S., and Metz, C. RFC 2428, FTP Extensions for IPv6 and NATs. The Internet Society. September 1998.

Piscitello, D. RFC 1639, FTP Operation Over Big Address Records (FOOBAR). Network Working Group. June 1994.

Postel, Jon, and Joyce Reynolds. RFC 959, File Transfer Protocol (FTP ). Network Information Center. October 1985.

St. Johns, Mike. RFC 931, Authentication Server. Network Working Group. January 1985.

Linn, J., Generic Security Service Application Program Interface Version 2, Update 1, RFC 2743. The Internet Society, January 2000.

Horowitz, M., Lunt, S., FTP Security Extensions, RFC 2228. The Internet Society, October 1997.

in.ftpd logs various errors to syslogd(1M), with a facility code of daemon.

The anonymous FTP account is inherently dangerous and should be avoided when possible.

PAM does not support anonymous logins.

The FTP Server must perform certain tasks as the superuser, for example, the creation of sockets with privileged port numbers. It maintains an effective user ID of the logged in user, reverting to the superuser only when necessary.

The FTP Server no longer supports the /etc/default/ftpd file. Instead of using UMASK=nnn to set the umask, use the defumask capability in the ftpaccess file. The banner greeting text capability is also now set through the ftpaccess file by using the greeting text capability instead of by using BANNER="...". However, unlike the BANNER string, the greeting text string is not passed to the shell for evaluation. See ftpaccess(4).

The pam_unix(5) module is no longer supported. Similar functionality is provided by pam_authtok_check(5), pam_authtok_get(5), pam_authtok_store(5), pam_dhkeys(5), pam_passwd_auth(5), pam_unix_account(5), pam_unix_auth(5), and pam_unix_session(5).