oftpd: a Secure, Modern FTP Dæmon
One of the most important rules of Linux security is “Don't run anything as root that you don't have to”. oftpd, like Apache and other dæmons, follows this rule by dropping root privilege right after it starts listening on its standard, root-only port. If you're looking at the oftpd source, this is found in src/oftpd.c, where “create our main listener” is followed immediately by “set user to be as inoffensive as possible”. So, you'll be starting oftpd as root, but you'll need to add a user that it can run as afterward. Run adduser or useradd (whichever one your distribution provides) to create a new user called “oftpd”.
As root, start oftpd like this:
/usr/local/sbin/oftpd oftpd /home/httpd/html
The two arguments are: first, the user to run as and, second, the FTP directory to use. You can point both Apache and oftpd at the same directory so that all of your content is available either by HTTP or FTP. Substitute your own web server's “DocumentRoot” directory as the second argument. You can always make a separate FTP directory if you want, but this way lets people use HTTP to get files from your server if they're behind a misconfigured firewall that doesn't let FTP connections through.
If oftpd starts without errors, try visiting localhost with your favorite FTP client or ftp://localhost/ with your web browser. You should be able to get a directory listing of your chosen FTP directory. If you do, you're almost done. Have a refreshing beverage. Two bad things can happen with the above command, but they're easy to deal with. If you get an “invalid user name” error, you didn't create the oftpd user correctly. If you specify a nonexistent directory, you won't immediately see an error message, but you won't get a directory listing, and oftpd will log an error using syslog. On my Debian box, syslog puts oftpd's log messages in daemon.log. You can change that by editing /etc/syslogd.conf, but that's another article.
As root, kill oftpd for now with:
Next, you'll need to make an init script to start and stop oftpd. As root, cd into your init.d directory (/etc/rc.d/init.d on Red Hat, /etc/init.d on Debian) and pick out an init script to copy and edit (I like to copy new init scripts from the one for sshd, because it's very simple). Two small features to watch for: oftpd (version 0.2.0) does not currently write a pidfile in /var/run, and the PID of the running process is not the same as the PID of the process you started because oftpd forks when it starts up. So in the “stop” section of your init script, you'll need to take the appropriate steps to kill oftpd by name instead of by PID. On Debian, use the --exec option of start-stop-dæmon (see Listing 1). However, the killproc function on Red Hat will automatically kill by name if it can't find a pidfile.
If you installed a package instead of source, everything up to this point will have been done for you. Check that the init script points oftpd to the appropriate directory, but that's about it. Now, whether you installed from source or from a package, just cd into your init.d directory and do:
Then check ftp://localhost/ to make sure oftpd is up; use your distribution's runlevel management tool to set oftpd to start automatically when you enter your default runlevel; and ftp to your server from the outside to make sure some firewall weenie hasn't filtered FTP out of your network. Now you have a working, simple FTP server suitable for software archives of all kinds. You can mirror your favorite Linux distribution and invite everyone you know to bring their boxes over for a quick network install.
Getting Started with DevOps - Including New Data on IT Performance from Puppet Labs 2015 State of DevOps Report
August 27, 2015
12:00 PM CDT
DevOps represents a profound change from the way most IT departments have traditionally worked: from siloed teams and high-anxiety releases to everyone collaborating on uneventful and more frequent releases of higher-quality code. It doesn't matter how large or small an organization is, or even whether it's historically slow moving or risk averse — there are ways to adopt DevOps sanely, and get measurable results in just weeks.
Free to Linux Journal readers.Register Now!
- Hacking a Safe with Bash
- Django Models and Migrations
- Secure Server Deployments in Hostile Territory, Part II
- The Controversy Behind Canonical's Intellectual Property Policy
- Home Automation with Raspberry Pi
- Huge Package Overhaul for Debian and Ubuntu
- Shashlik - a Tasty New Android Simulator
- Embed Linux in Monitoring and Control Systems
- KDE Reveals Plasma Mobile
- diff -u: What's New in Kernel Development