oftpd: a Secure, Modern FTP Dæmon

One of the most important rules of Linux security is “Don't run anything as root that you don't have to”. oftpd, like Apache and other dæmons, follows this rule by dropping root privilege right after it starts listening on its standard, root-only port. If you're looking at the oftpd source, this is found in src/oftpd.c, where “create our main listener” is followed immediately by “set user to be as inoffensive as possible”. So, you'll be starting oftpd as root, but you'll need to add a user that it can run as afterward. Run adduser or useradd (whichever one your distribution provides) to create a new user called “oftpd”.

As root, start oftpd like this:

/usr/local/sbin/oftpd oftpd /home/httpd/html

The two arguments are: first, the user to run as and, second, the FTP directory to use. You can point both Apache and oftpd at the same directory so that all of your content is available either by HTTP or FTP. Substitute your own web server's “DocumentRoot” directory as the second argument. You can always make a separate FTP directory if you want, but this way lets people use HTTP to get files from your server if they're behind a misconfigured firewall that doesn't let FTP connections through.

If oftpd starts without errors, try visiting localhost with your favorite FTP client or ftp://localhost/ with your web browser. You should be able to get a directory listing of your chosen FTP directory. If you do, you're almost done. Have a refreshing beverage. Two bad things can happen with the above command, but they're easy to deal with. If you get an “invalid user name” error, you didn't create the oftpd user correctly. If you specify a nonexistent directory, you won't immediately see an error message, but you won't get a directory listing, and oftpd will log an error using syslog. On my Debian box, syslog puts oftpd's log messages in daemon.log. You can change that by editing /etc/syslogd.conf, but that's another article.

As root, kill oftpd for now with:

killall oftpd

Next, you'll need to make an init script to start and stop oftpd. As root, cd into your init.d directory (/etc/rc.d/init.d on Red Hat, /etc/init.d on Debian) and pick out an init script to copy and edit (I like to copy new init scripts from the one for sshd, because it's very simple). Two small features to watch for: oftpd (version 0.2.0) does not currently write a pidfile in /var/run, and the PID of the running process is not the same as the PID of the process you started because oftpd forks when it starts up. So in the “stop” section of your init script, you'll need to take the appropriate steps to kill oftpd by name instead of by PID. On Debian, use the --exec option of start-stop-dæmon (see Listing 1). However, the killproc function on Red Hat will automatically kill by name if it can't find a pidfile.

Listing 1. oftpd init Script for Debian

If you installed a package instead of source, everything up to this point will have been done for you. Check that the init script points oftpd to the appropriate directory, but that's about it. Now, whether you installed from source or from a package, just cd into your init.d directory and do:

./oftpd start

Then check ftp://localhost/ to make sure oftpd is up; use your distribution's runlevel management tool to set oftpd to start automatically when you enter your default runlevel; and ftp to your server from the outside to make sure some firewall weenie hasn't filtered FTP out of your network. Now you have a working, simple FTP server suitable for software archives of all kinds. You can mirror your favorite Linux distribution and invite everyone you know to bring their boxes over for a quick network install.

Resources