oftpd: a Secure, Modern FTP Dæmon
One of the most important rules of Linux security is “Don't run anything as root that you don't have to”. oftpd, like Apache and other dæmons, follows this rule by dropping root privilege right after it starts listening on its standard, root-only port. If you're looking at the oftpd source, this is found in src/oftpd.c, where “create our main listener” is followed immediately by “set user to be as inoffensive as possible”. So, you'll be starting oftpd as root, but you'll need to add a user that it can run as afterward. Run adduser or useradd (whichever one your distribution provides) to create a new user called “oftpd”.
As root, start oftpd like this:
/usr/local/sbin/oftpd oftpd /home/httpd/html
The two arguments are: first, the user to run as and, second, the FTP directory to use. You can point both Apache and oftpd at the same directory so that all of your content is available either by HTTP or FTP. Substitute your own web server's “DocumentRoot” directory as the second argument. You can always make a separate FTP directory if you want, but this way lets people use HTTP to get files from your server if they're behind a misconfigured firewall that doesn't let FTP connections through.
If oftpd starts without errors, try visiting localhost with your favorite FTP client or ftp://localhost/ with your web browser. You should be able to get a directory listing of your chosen FTP directory. If you do, you're almost done. Have a refreshing beverage. Two bad things can happen with the above command, but they're easy to deal with. If you get an “invalid user name” error, you didn't create the oftpd user correctly. If you specify a nonexistent directory, you won't immediately see an error message, but you won't get a directory listing, and oftpd will log an error using syslog. On my Debian box, syslog puts oftpd's log messages in daemon.log. You can change that by editing /etc/syslogd.conf, but that's another article.
As root, kill oftpd for now with:
Next, you'll need to make an init script to start and stop oftpd. As root, cd into your init.d directory (/etc/rc.d/init.d on Red Hat, /etc/init.d on Debian) and pick out an init script to copy and edit (I like to copy new init scripts from the one for sshd, because it's very simple). Two small features to watch for: oftpd (version 0.2.0) does not currently write a pidfile in /var/run, and the PID of the running process is not the same as the PID of the process you started because oftpd forks when it starts up. So in the “stop” section of your init script, you'll need to take the appropriate steps to kill oftpd by name instead of by PID. On Debian, use the --exec option of start-stop-dæmon (see Listing 1). However, the killproc function on Red Hat will automatically kill by name if it can't find a pidfile.
If you installed a package instead of source, everything up to this point will have been done for you. Check that the init script points oftpd to the appropriate directory, but that's about it. Now, whether you installed from source or from a package, just cd into your init.d directory and do:
Then check ftp://localhost/ to make sure oftpd is up; use your distribution's runlevel management tool to set oftpd to start automatically when you enter your default runlevel; and ftp to your server from the outside to make sure some firewall weenie hasn't filtered FTP out of your network. Now you have a working, simple FTP server suitable for software archives of all kinds. You can mirror your favorite Linux distribution and invite everyone you know to bring their boxes over for a quick network install.
|PostgreSQL, the NoSQL Database||Jan 29, 2015|
|HPC Cluster Grant Accepting Applications!||Jan 28, 2015|
|Sharing Admin Privileges for Many Hosts Securely||Jan 28, 2015|
|Red Hat Enterprise Linux 7.1 beta available on IBM Power Platform||Jan 23, 2015|
|Designing with Linux||Jan 22, 2015|
|Wondershaper—QOS in a Pinch||Jan 21, 2015|
- PostgreSQL, the NoSQL Database
- Sharing Admin Privileges for Many Hosts Securely
- HPC Cluster Grant Accepting Applications!
- Internet of Things Blows Away CES, and it May Be Hunting for YOU Next
- Designing with Linux
- Wondershaper—QOS in a Pinch
- Ideal Backups with zbackup
- Red Hat Enterprise Linux 7.1 beta available on IBM Power Platform
- Slow System? iotop Is Your Friend
- January 2015 Issue of Linux Journal: Security
Editorial Advisory Panel
Thank you to our 2014 Editorial Advisors!
- Jeff Parent
- Brad Baillio
- Nick Baronian
- Steve Case
- Chadalavada Kalyana
- Caleb Cullen
- Keir Davis
- Michael Eager
- Nick Faltys
- Dennis Frey
- Philip Jacob
- Jay Kruizenga
- Steve Marquez
- Dave McAllister
- Craig Oda
- Mike Roberts
- Chris Stark
- Patrick Swartz
- David Lynch
- Alicia Gibb
- Thomas Quinlan
- Carson McDonald
- Kristen Shoemaker
- Charnell Luchich
- James Walker
- Victor Gregorio
- Hari Boukis
- Brian Conner
- David Lane