oftpd: a Secure, Modern FTP Dæmon
One of the most important rules of Linux security is “Don't run anything as root that you don't have to”. oftpd, like Apache and other dæmons, follows this rule by dropping root privilege right after it starts listening on its standard, root-only port. If you're looking at the oftpd source, this is found in src/oftpd.c, where “create our main listener” is followed immediately by “set user to be as inoffensive as possible”. So, you'll be starting oftpd as root, but you'll need to add a user that it can run as afterward. Run adduser or useradd (whichever one your distribution provides) to create a new user called “oftpd”.
As root, start oftpd like this:
/usr/local/sbin/oftpd oftpd /home/httpd/html
The two arguments are: first, the user to run as and, second, the FTP directory to use. You can point both Apache and oftpd at the same directory so that all of your content is available either by HTTP or FTP. Substitute your own web server's “DocumentRoot” directory as the second argument. You can always make a separate FTP directory if you want, but this way lets people use HTTP to get files from your server if they're behind a misconfigured firewall that doesn't let FTP connections through.
If oftpd starts without errors, try visiting localhost with your favorite FTP client or ftp://localhost/ with your web browser. You should be able to get a directory listing of your chosen FTP directory. If you do, you're almost done. Have a refreshing beverage. Two bad things can happen with the above command, but they're easy to deal with. If you get an “invalid user name” error, you didn't create the oftpd user correctly. If you specify a nonexistent directory, you won't immediately see an error message, but you won't get a directory listing, and oftpd will log an error using syslog. On my Debian box, syslog puts oftpd's log messages in daemon.log. You can change that by editing /etc/syslogd.conf, but that's another article.
As root, kill oftpd for now with:
Next, you'll need to make an init script to start and stop oftpd. As root, cd into your init.d directory (/etc/rc.d/init.d on Red Hat, /etc/init.d on Debian) and pick out an init script to copy and edit (I like to copy new init scripts from the one for sshd, because it's very simple). Two small features to watch for: oftpd (version 0.2.0) does not currently write a pidfile in /var/run, and the PID of the running process is not the same as the PID of the process you started because oftpd forks when it starts up. So in the “stop” section of your init script, you'll need to take the appropriate steps to kill oftpd by name instead of by PID. On Debian, use the --exec option of start-stop-dæmon (see Listing 1). However, the killproc function on Red Hat will automatically kill by name if it can't find a pidfile.
If you installed a package instead of source, everything up to this point will have been done for you. Check that the init script points oftpd to the appropriate directory, but that's about it. Now, whether you installed from source or from a package, just cd into your init.d directory and do:
Then check ftp://localhost/ to make sure oftpd is up; use your distribution's runlevel management tool to set oftpd to start automatically when you enter your default runlevel; and ftp to your server from the outside to make sure some firewall weenie hasn't filtered FTP out of your network. Now you have a working, simple FTP server suitable for software archives of all kinds. You can mirror your favorite Linux distribution and invite everyone you know to bring their boxes over for a quick network install.
Fast/Flexible Linux OS Recovery
On Demand Now
In this live one-hour webinar, learn how to enhance your existing backup strategies for complete disaster recovery preparedness using Storix System Backup Administrator (SBAdmin), a highly flexible full-system recovery solution for UNIX and Linux systems.
Join Linux Journal's Shawn Powers and David Huffman, President/CEO, Storix, Inc.
Free to Linux Journal readers.Register Now!
- Download "Linux Management with Red Hat Satellite: Measuring Business Impact and ROI"
- Sony Settles in Linux Battle
- Libarchive Security Flaw Discovered
- Profiles and RC Files
- Maru OS Brings Debian to Your Phone
- Snappy Moves to New Platforms
- Understanding Ceph and Its Place in the Market
- Astronomy for KDE
- The Giant Zero, Part 0.x
- Git 2.9 Released
With all the industry talk about the benefits of Linux on Power and all the performance advantages offered by its open architecture, you may be considering a move in that direction. If you are thinking about analytics, big data and cloud computing, you would be right to evaluate Power. The idea of using commodity x86 hardware and replacing it every three years is an outdated cost model. It doesn’t consider the total cost of ownership, and it doesn’t consider the advantage of real processing power, high-availability and multithreading like a demon.
This ebook takes a look at some of the practical applications of the Linux on Power platform and ways you might bring all the performance power of this open architecture to bear for your organization. There are no smoke and mirrors here—just hard, cold, empirical evidence provided by independent sources. I also consider some innovative ways Linux on Power will be used in the future.Get the Guide