Red Hat Linux 7 Unleashed

Red Hat Linux 7 Unleashed

By William Ball

How the FTP Server Works

FTP service is controlled from the /etc/inetd.conf file and is automatically invoked whenever someone connects to the FTP port. (Ports are logical associations from a network connection to a specific service. For example, port 21 associates to FTP, port 23 associates to Telnet, and so on.) When a connection is detected, the FTP daemon (/usr/sbin/in.ftpd) is invoked and the session begins. The default /etc/inetd.conf file installed with your Red Hat distribution contains the necessary line for this step to occur.

After the server is invoked, the client needs to provide a username and corresponding password. Two special usernames—anonymous and ftp—have been set aside for the purpose of allowing access to the public files. Any other access requires the user to have an account on the server.

If a user accesses the server using an account, an additional check is performed to ensure that the user has a valid shell. If the user doesn't, access is denied to the system. This check is useful if you want to limit user access to a server (for example, POP mail) and do not want users logging in via Telnet or FTP. Valid shells are listed in the your system's /etc/shells file. If you install a new shell, be sure to add it to your /etc/shells listing so people using that shell can connect to the system via FTP.

Users accessing your system's FTP server are placed in their home directories when they first log in. At that point, they can change to any directories on the system to which they have permission. Anonymous users, on the other hand, have several restrictions.

Anonymous users are placed in the home directory for the FTP users. By default, this directory is set to /home/ftp by the anonftp RPM package. Note that other Linux distributions may use a different default FTP directory! After the users get there, the FTP server executes a chroot system call, effectively changing the program's root directory to the FTP users' directories. Access is denied to any other directories in the system, including /bin, /etc, and /lib. This change in the root directory prevents the server from seeing /etc/passwd, /etc/group, and other necessary binaries (such as /bin/ls). To make up for this change, the server package creates bin, etc, and lib directories under /home/ftp. This is where necessary libraries and programs (such as ls) are placed; it's also where the server software can access them even after the chroot system call has been made.

For security reasons, files placed under the /home/ftp directory have their permissions set such that only the server can see them. (This is done automatically during anonftp's install.) Any other directories created under /home/ftp should be set up so they are world-readable. Most anonymous FTP sites place such files under the pub subdirectory.

Share ThisShare This

Informit Network