oftpd: a Secure, Modern FTP Dæmon
FTP dæmons may not get much attention, but what attention they do get is in the form of security advisory after security advisory. There's not much hack value for most people in supporting something as old-school as FTP, so the state of the art has languished—until now. This article will introduce you to Shane Kerr's oftpd, an incredibly simple FTP dæmon that, we think, will start to replace the old, full-featured dæmons currently shipping on (and creating security issues for) Linux distributions everywhere.
Rick Moen, a Linux security guru who is also famous for his ability to install Linux on many obsolete or unusual systems, runs an FTP server mostly as an archive of Linux distributions to install over the network. Boot from floppy, select “Install from FTP” and Bob's your uncle. No need to figure out how to insmod the driver for somebody's ten-year-old 1x CD-ROM drive. (Please, don't everyone go knocking on Rick's door with your VIC-20s and PDP-8s; he gets plenty of challenges from regular installfests and user-group meetings.)
FTP remains useful for three reasons, Rick says. First, FTP provides automatic, informative directory listings, including file modification times, to facilitate mirroring. Second, there's no “index.html” to override a dæmon-generated directory listing in FTP, so it's easy to mirror entire directory trees or grab them with snarf.
Finally, Rick finds that you can get small FTP clients for legacy OSes or special situations where an HTTP client won't fit. For example, Rick used a MacOS FTP client to copy Debian floppies to an old Macintosh with no CD-ROM and insufficient memory for a web browser. People who install a lot of Red Hat or Red Hat-based systems using Kickstart floppies soon find that FTP installs are fast, convenient and let you keep a single software archive up-to-date on the FTP server. You can do the same thing with an NFS (Network File System) install, but FTP is faster.
The qualities people need from an FTP dæmon have changed since the old dæmons were written. First, the days of logging in to an FTP site with a username and password (which get sent in plaintext over the Net) are gone, gone, gone. People are using ssh, scp and other encrypted tools to protect their passwords on the Net when they transfer nonpublic files, so the FTP dæmon no longer needs to authenticate users. Second, performance matters. People aren't just using FTP to get an occasional piece of software or pass along work to colleagues. FTP servers should be prepared to get slammed by many clients all installing an entire Linux distribution at once.
So, the two goals for running a modern FTP server are: for security, simplify both your Policy and FTP dæmon to “anonymous FTP only”, and look for a dæmon that offers good performance. That's what brings us to oftpd.
For security, oftpd runs as a non-root user except for essential setup tasks. It runs “chrooted” to the public FTP directory. These features buy you a lot, security-wise, and an old-fashioned FTP dæmon that allows users to log in with a username and password that can't match it. For simplicity and performance, oftpd itself generates directory listings instead of running ls.
The first step in setting up oftpd is to get rid of the old ftp entry in inetd.conf. The FTP dæmon that probably came with your Linux distribution gets run by inetd, while oftpd runs standalone for speed. Just comment out the ftp line with a # at the beginning, so it looks something like this:
# ftp stream tcp nowait root /usr/sbin/tcpd in.ftpd -l -a
Now killall -HUP inetd to restart inetd, so that it knows not to respond to connections on the FTP port. If you ftp localhost you should get a Connection refused.
Now, we're ready to move on to oftpd itself. First, the easy part. To compile and install, just unpack the tar file, cd into the resulting directory and use the One True GNU Way (./configure; make; make install). To keep everything in its appropriate, canonical place, supply the bindir argument to the configure script, so that make install will put the oftpd executable in /usr/local/sbin, which is the appropriate directory for locally built dæmons:
sh ./configure --bindir=/usr/local/sbin && make
Then su root and do:
make installThe installation is so generic that the INSTALL document in the version of oftpd I used begins simply, “These are generic installation instructions”. That's a good thing. By the time you read this, there will probably be RPM or deb packages for your favorite distribution, so check there first for an even easier install.
The above compile and install step, as well as the following three steps, will be handled for you if you install oftpd from an RPM or deb package, but you'll have to complete them if you're installing oftpd from source.
|Bitcoin on Amazon! Sort of...||Sep 28, 2016|
|Free Today: September Issue of Linux Journal (Retail value: $5.99)||Sep 27, 2016|
|nginx||Sep 27, 2016|
|Epiq Solutions' Sidekiq M.2||Sep 26, 2016|
|Nativ Disc||Sep 23, 2016|
|Android Browser Security--What You Haven't Been Told||Sep 22, 2016|
- Free Today: September Issue of Linux Journal (Retail value: $5.99)
- Android Browser Security--What You Haven't Been Told
- Bitcoin on Amazon! Sort of...
- Epiq Solutions' Sidekiq M.2
- Readers' Choice Awards 2013
- The Many Paths to a Solution
- Nativ Disc
- Tech Tip: Really Simple HTTP Server with Python
- Identity: Our Last Stand
Pick up any e-commerce web or mobile app today, and you’ll be holding a mashup of interconnected applications and services from a variety of different providers. For instance, when you connect to Amazon’s e-commerce app, cookies, tags and pixels that are monitored by solutions like Exact Target, BazaarVoice, Bing, Shopzilla, Liveramp and Google Tag Manager track every action you take. You’re presented with special offers and coupons based on your viewing and buying patterns. If you find something you want for your birthday, a third party manages your wish list, which you can share through multiple social- media outlets or email to a friend. When you select something to buy, you find yourself presented with similar items as kind suggestions. And when you finally check out, you’re offered the ability to pay with promo codes, gifts cards, PayPal or a variety of credit cards.Get the Guide