Using the Washington University FTP Server (WU-FTPD)

The anonymous FTP user

Because most visitors to an FTP site from the Internet will not have an individual login account to the computer, the anonymous user name is used on public FTP sites. With the anonymous user name, anyone who can reach the FTP site from the network can log in to the server and have minimal permission for its use. Typically, "minimal" means that an anonymous user can only copy files from (and not write files to) the FTP server and that only selected directories are even visible.

Here is an example of a login session from an anonymous user:

$ ftp maple
Connected to maple
220 maple FTP server (Version wu-2.6.2-8) ready.
Name (maple:mike): anonymous
331 Guest login ok, send your complete e-mail address as password.
Password: *********
230 Guest login ok, access restrictions apply.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp>
ftp> bye
221-You have transferred 0 bytes in 0 files.
221-Total traffic for this session was 313 bytes in 0 transfers.
221-Thank you for using the FTP service on maple.
221 Goodbye.

While I was logged on to the FTP server, I had access to all files and directories that the server allowed to the anonymous user. That would probably include only a limited area of the server's system (the /var/ftp directory, by default, on Red Hat Linux systems). There were probably restrictions on what I could change, delete, or create on the server as an anonymous user as well.

One of the great advantages of anonymous FTP is that it can easily be automated. Instead of using the ftp command, users can simply type the FTP address of the server into a Web browser. Users don't even need to know that they are being logged in as an anonymous user when they visit the FTP site. The list of files and directories requested simply appears.

defaultserver private

Real users

The users who have valid login accounts to your computer can also access the computer via FTP. These users can have any user name that the administrator defines. To use FTP, they can simply type their user names and passwords at the FTP prompts. At that point, they will be logged in to the FTP server.

Instead of having /var/ftp as their root directory, however, real users have their regular home directory (such as /home/user, where user is the user name) as their root directory and current directory when they log in. Like the anonymous user, the real user has special restrictions with regard to the file system. By default, real users cannot access any files outside of their home directory and related subdirectories.

No special configuration needs to be done in the /etc/ftpaccess file to allow a user with a real account to connect to the server through FTP. However, if you want to provide one or more real users with the same access to the file system that they would have if they logged in directly, you could redefine that user or group as real by setting a realuser or realgroup value for the user or group, respectively. (For example, add a line that reads realuser joe to give the user named joe access to files outside of his home directory.)

To prevent any real user from using the FTP service, you can simply add the person's user name to the /etc/ftpusers list. By default, these users are excluded because they are on this list: root, bin, daemon, adm, lp, sync, shutdown, halt, mail, news, uucp, operator, games, and nobody. Most of those users are administrative accounts that could be exploited. In the /etc/ftpaccess file, all administrative accounts except the ftp user and group are denied access to the FTP service by default.

Guest users

A guest user is sort of halfway between a real user and an anonymous user. You can assign any name as a guest user. However, the guest user is limited to a restricted area of the file system, typically the user's home directory.

Using guest user accounts is a great way to give specific users permission to add files to and remove them from a specific part of your file system but not allow them to do much else. This is useful, for example, if you want to give users a place to set up their own Web pages.

In general terms, an FTP guest user will have an account set up in the Linux /etc/passwd file, then that user will be defined as either a guestuser or guestgroup in the /etc/ ftpaccess file. The following is an example of how to set up an FTP guest user account (you must be the root user to do this procedure):

1. Add the user account as you would normally. For example, to add a user named mike with a home directory of /home/mike, type the following (as root user):

   # useradd -m mike
   

2. Add a password for mike using the passwd command (entering it twice, as prompted):

   # passwd mike
   Changing password for user mike.
   New password: ********
   Retype new password: ********
   

3. Edit the user's account information in /etc/passwd so that the user's root directory is changed to the restricted directory (for example, the user's /home directory). Here is an example of how that new entry would look for the user named mike:

   mike:x:501:501:guest acct:/home/mike/./pub:/etc/ftponly

4. The dot (.) after /home/mike makes the /home/mike directory on the FTP server the root directory for mike. When mike logs in, his current directory is /home/mike/pub. The /etc/ftponly value prevents a shell from starting up (such as /bin/bash) if mike were to log in from a regular Linux prompt.

5. Copy the sample ftponly file to /etc and make it executable as follows:

   # cp /usr/share/doc/wu-ftpd*/examples/ftponly /etc/
   # chmod 755 /etc/ftponly
   

6. Add the line /etc/ftponly to the /etc/shells file.

7. Create directories needed for the guest user's home directory to have everything FTP needs to work properly. To do this, I just copied everything from the /var/ftp directory structure (as root user) to my guest user's home directory (/home/mike). After that, I changed group assignment of /home/mike/pub to mike:

   # cp -r /var/ftp/* /home/mike
   # chgrp mike /home/mike/pub
   

8. Add the necessary definitions to /etc/ftpaccess. If you changed the default (guestuser *), which makes all real users into guest users, you need to define the user as a guest login. For example, to define mike as a guest login, add the following to /etc/ftpaccess:

   guestuser mike

   Cross-Reference?

   With just guestuser mike defined, the user mike has /home/mike as his root directory and he can get files (but not put them on the server). Also, he can browse the directory structure below /home/mike only. To add to or change permissions, see the section on controlling FTP access later in this chapter.

At this point, the guest user can use the ftp command to connect to the server and have access to only those files and directories that are under the user's restricted directory.

Creating the FTP directory structure

Because you are providing a limited view of the file system to those who use your FTP service, you must provide everything they need within the root file system that they can access (typically, /var/ftp). How to set up the minimal directory structure for FTP is described in the section on setting up guest users.

A viable directory structure is provided in the /var/ftp directory when you install the FTP service in Red Hat Linux (specifically, the anonftp package). After that, most of what you want to share with the public can be arranged in the /pub directory structure that you create. For directories containing information that is restricted to certain classes of user, you may want to create a different root directory (such as /local).

Specific directories can be included or excluded within the directory structure using a variety of parameters in the /etc/ftpaccess file. You can choose which directories allow upload and download. You can also set whether users can rename, delete, overwrite, or change permissions of files. See the sections on controlling FTP access for further information on setting up user directories and files.

Adding helpful information

The FTP service on your Red Hat Linux computer is set up to automatically display messages and to alert the user to the existence of README files at different times in a user's navigation of your site. When FTP is installed, however, none of these files exist. So to help the navigation of your site, you need to create these files.

readme  README*   login
readme  README*   cwd=*

230-Please read the file README
230- it was last modified on Thu May 23 16:46:20 2002 – 0 days ago

message  /welcome.msg   login
message  .message       .cwd=*

Changing FTP login greetings

When users log in to your FTP server, they see several standard greetings. You can change the greetings they see and what those greetings include by adding to your /etc/ftpaccess file.

$ ftp maple
Connected to maple (10.0.0.11).
220 maple FTP server (Version wu-2.6.2-8) ready.
Name (maple:mike):

greeting terse

$ ftp maple
Connected to maple (10.0.0.11).
220 FTP server ready.
Name (maple:mike):

hostname ftppine

banner /etc/ftpbanner.msg

Creating user classes

By setting up user classes, you create a method of assigning access to different resources to different groups of users. Any user who does not fall into a class will not have access to your FTP server. That's why the default class includes all users with the following line:

class      all      real,guest,anonymous    *

First decide which groups of users you want to treat separately. An effective technique is to define your local users as one class and all other users as another class. The class keyword lets you assign classes based on network address and types of user within that address (that is, real, guest, or anonymous). For example, you may want to assign one set of permissions for all users within your Internet domain and another set for everyone else. Here's how to do that:

class  home   real,guest,anonymous  10.0.0.0/8
class  world  real,guest,anonymous  *

In this example, all users who come from a host computer with an address on network number 10.0.0.0 (presumably your local network) are assigned to the "home" class. Users from other networks are assigned to the "world" class. You can use a network number or a domain name.

As discussed earlier, user types defined within each class are represented by one of the following keywords:

• real — For users who have a login account on the local computer.

• guest — For users with real login accounts who are designated as guestusers or guestgroups in the /etc/ftpaccess file.

• anonymous — For anyone who logs in under the anonymous user name.

With class names assigned, you can assign limitations or permissions to any of those classes.

Allowing uploading of incoming files

By default, anonymous users are not permitted to upload files to your FTP server. For uploading to occur, you must specifically allow uploading in the /etc/ftpaccess file, using the upload parameter. Also, specific parameters deal with whether guest and anonymous users can delete, overwrite, rename, or change permissions of files and directories. (Remember that allowing public uploading of files to your FTP server can pose a significant security risk.)

upload   /var/ftp  /incoming   yes   mike  sales    0600
upload   /var/ftp  /testdir    yes   ftp   ftp      0666

upload class=home /var/ftp /incoming/local yes ftp guest 0666

noretrieve relative class=world /pub/homestuff
noretrieve absolute /etc/hosts /etc/inittab
noretrieve core personal money

all-retrieve relative class=world /pub/homestuff/publicfile.txt

chmod      yes   guest,class=home
chmod      no    anonymous

delete      yes   class=home
delete      no    anonymous,guest

overwrite   no    anonymous,guest,class=home

rename      no     anonymous,guest

umask       yes    anonymous,guest

Limiting the number of concurrent users

You can limit how many users at a time can be logged in to your FTP server based on the class of the user. This is an excellent way of making sure that your local users can access your server, even when there is extraordinary demand from the outside world. (By not defining any limit values, you ensure that connections will not be refused based on there being too many connections.) Here are some examples of limit entries:

limit  home   40    Any       /etc/ftp.overlimit
limit  world  120   Any       /etc/ftp.overlimit

The first example limits the number of users in the home class (which you assigned your local users to) who can be connected at any one time to 40. The world class of users is limited to 120 simultaneous connections to your server. If the maximum number of connections for a group is reached, a connection from the user is refused and a message that you created in /etc/ftp.overlimit is presented to the user.

The keyword Any indicates that this limitation is in effect on any day. You could, instead, assign the particular limit definition to apply to a particular day or time of day. For example, to set a limit that applies only on weekends, you could do the following:

limit   world   140    SaSu    /etc/ftp.overlimit

You can also create a limit entry based on time rather than days. To indicate a time period from 10 p.m. to 5 a.m. where access could be extended, you would enter the numbers 2200–0500, instead of SaSu, in the example. If conflicts between limit entries occur, the first matching limit takes precedence.

Limiting uploading and downloading

Downloading is what most people go to FTP sites to do. Typically, the disk area assigned to anonymous users contains documents or software that people can freely download over the network. Some options, however, enable you to limit how much of the computer's resources a user can consume while downloading files. The following sections describe some of them.

file-limit     total  100     home
file-limit     in     5       world
file-limit     out    30      world

byte-limit    total       102400000   home
byte-limit    out         51200000    world
byte-limit    in          25600000    world

limit-time anonymous 120
limit-time guest     240

Denying access from hosts and users

You can deny certain host computers from having access to your FTP server. Likewise, you can deny access for anonymous, guest, and real accounts in different ways.

deny  maple,snowbird,oak  /etc/ftpdeny.msg

guestserver maple,pine,snowbird

root
bin
daemon
adm
lp
sync
shutdown
halt
mail
news
uucp
operator
games
nobody

deny-gid   %-110
deny-uid   %-110
allow-uid  uucp news

Starting WU-FTPD

To enable WU-FTPD, which is disabled by default, you have to change the disable = yes entry in the /etc/xinetd.d/wu-ftpd file. Open the file as root user, using any text editor, and change the line to read as follows:

disable = no

Next, you need to restart the xinetd daemon so that the new changes are picked up. You can do that by typing the following as root user:

# /etc/init.d/xinetd restart
Stopping xinetd:     [  OK  ]
Starting xinetd:     [  OK  ]

Now try using the ftp command or other FTP client to connect to your WU-FTPD server.

Shutting down WU-FTPD

The ftpshut command shuts down the FTP service. Any users who are currently connected to the FTP service are disconnected. When they type FTP commands, they will see a message such as "FTP server shut down —- please try again later" or simply "Not connected."

With the ftpshut command, you can either shut down the server immediately or set it to shut down in the future. To shut down the service immediately, type the following:

# ftpshut now

You can set the server to shut down at a specific time by either adding the number of minutes from now that you want the server to shut down or by entering a particular time in the future. Here are some examples:

# ftpshut 20:18
# ftpshut -l 20 -d 3

In the first example, the server is set to shut down at 20:18 (or 8:18 p.m. on a 12-hour clock). In the second example, the -l option specifies the number of minutes left before the server will be shut down (in this example, 20 minutes). The -d option specifies the number of minutes before the FTP service shuts down that users are disconnected from the server. (If no -d option is specified, users are disconnected five minutes before the server shuts down.)

To be less antisocial about shutting down your FTP service, it's nice to send a warning message to let users know that FTP is going down. Here's an example of how to send a shutdown-warning message when you shut down your FTP server:

ftpshut 20:15 "FTP will go down soon. Finish and disconnect."

Restarting FTP

After ftpshut is run, it creates a file called shutmsg in both the /etc and /var/ftp/etc directories. When your FTP server shuts down, it stays down until these files are removed. So, to restart your FTP server, all you have to do is the following (as root user):

# rm /etc/shutmsg /var/ftp/etc/shutmsg

The above command removes the files. At this point, users will immediately be able to reconnect to your FTP server. Another command you could use to restart your FTP server is the ftprestart command.

Logging connections

When the ftpd daemon is enabled (from an entry in the /etc/xinetd.d/wu-ftpd file), the -l option is added to the command line. This option causes each FTP session to be logged to the syslog facility. As a result, messages that provide some of the following information about FTP activities will be sent to your /var/log/messages file:

• User name, host name, and IP address of the user trying to connect to your FTP service.

• The user name logged in under (anonymous, and so on).

• How and when the FTP service was disconnected for the user.

You can use this information to monitor the activities on your server. For example, if someone is trying to break into your system, you can see multiple failed login attempts. You can also see if you are getting more anonymous FTP requests than you can handle.

Logging file transfers

If there are file transfers during the session, they are logged to the /var/log/xferlog. In that file you can see both incoming and outgoing file transfers. Here are two examples of log entries in the /var/log/xferlog file:

Sat Aug 23 21:26:20 2003 1 oak 1625 /in/log b _ i r mike ftp 1 root c
Sat Aug 23 21:27:23 2003 1 pine 124 /pub/a.txt a o r mike ftp 1 root c

In the first example, the transfer occurred at 21:26:20 on Saturday, August 23, 2003. The transfer time was only one (1) second. The remote host name is oak, and the size of the file is 1625 bytes. The transferred file was named log and was put in the /in directory on the FTP server. The type of transfer was binary (b). The underscore ( _ ) indicates that no special action (such as file compression or decompression) was taken. The i shows that it was an incoming transfer. The user was a real user (r) named mike. The service invoked was ftp. Authentication was done using RFC931 authentication (1). The user id returned by the authentication method was root. The c indicates that the transfer was completed.

In the second example, several items are of interest. The remote computer name was pine. The file was transferred using an ASCII transfer method (a). The file /pub/a.txt was transferred from the file server (o).