Andrew Hudson - Fedora™ Unleashed, 2008 edition

Oct 6 12:21:59 shuttle2 ftpd[5229]: QUIT

Oct 6 12:21:59 shuttle2 ftpd[5229]: FTP session closed

The sample log shows the username and password entries for an anonymous login. The CWD entry shows that a cdcommand is used to navigate to the pubdirectory. Note that the commands shown do not necessarily reflect the syntax the user typed, but instead list corresponding system calls the FTP server received. For example, the LIST entry is actually the lscommand.

Two other logging commands are useful in the /etc/ftpaccessconfiguration file. This line enables the logging of security violations:

log security []

Violations are logged for anonymous, guest, and real users, as specified in the typelist— the same as other logcommands. If you do not specify a typelist, security violations for all users are logged.

This line writes a log of all files transferred to and from the server:

log transfers [ []]

typelistis the same as in log commands and log security lines. directionsis a comma- separated list of the keywords inboundfor uploaded files and outboundfor downloaded files. If no directionslist is given, both uploaded and downloaded files are logged. Inbound and outbound logging is turned on by default.

Controlling user activity is an important component of securing your system's server. The ftpaccessfile includes a number of commands that enable you to determine what users can and cannot execute during an FTP session. You can use these permission controls to allow users to change file permissions, delete and overwrite files, rename files, and create new files with default permissions. You learn how to use all these ftpaccessfile command lines in the following sections.

By default, all the ftpaccessfile command lines prohibit anonymous users from executing actions and enable authorized users to do so.

The chmodline determines whether a user can change a file's permissions. Here is the command line:

chmod

This command acts the same as the standard chmodcommand.

The yes|noparameter designates whether the command can be executed. typelistis a comma-delimited string of the keywords anonymous, guest, and real. If you do not specify a typeliststring, the command is applied to all users. An exhaustive description of its purpose and parameters can be found in the man page.

The deleteline determines whether the user can delete files with the rm command. Here's the command line:

delete

The yes|noparameter is used to turn this permission on or off, and typelistis the same as the chmodcommand.

This command line of the ftpaccessfile allows or denies users the ability to overwrite an existing file. Here's the command line:

overwrite

The FTP client determines whether users can overwrite files on their own local machines; this line specifically controls overwrite permissions for uploads to the server. The yes|noparameter toggles the permission on or off, and typelistis the same as in the chmodline.

You can enable or prevent a user from renaming files by using this command line:

rename

The yes|noparameter toggles the permission on or off, and typelistis the same comma-delimited string as in chmod.

This line determines whether the user is able to use the compresscommand on files:

compress []

The yes|noparameter toggles the permission on or off, and classglobis a regular expression string that specifies one or more defined classes of users. The conversions that result from the use of this command are specified in the ftpconversionsfile, which contains directions on what compression or extraction command is to be used on a file with a specific extension, such as .Zfor the compresscommand, .gzfor the gunzipcommand, and so on. See the section "Configuring FTP Server File-Conversion Actions" later in this chapter.

This line determines whether the user is able to use the tar(tape archive) command on files:

tar [ ...]

The yes|noparameter toggles the permission on or off, and classglobis a regular expression string that specifies one or more defined classes of users. Again, the conversions that result from the use of this command are specified in the ftpconversionsfile.

This line is a bit different from the other commands in the permission control section. The umaskcommand determines with what permissions a user can create new files; here it is.

umask

The yes|noparameter toggles based on whether a user is allowed to create a file with his default permissions when uploading a file. Like the overwritecommand you read about earlier in this section, this command line is specific to uploaded files because the client machine determines how new files are created from a download.

This aliascommand allows the administrator to provide another name for a directory other than its standard name:

alias

The aliasline applies to only the cdcommand. This line is particularly useful if a popular directory is buried deep within the anonymous FTP user's directory tree. The following is a sample entry:

alias linux-386 /pub/redhat/7.3/en/i386/

This line would allow the user to type cd linux-386and be automatically taken to the /pub/redhat/7.3/en/i386directory.

The cdpath

line specifies the order in which the cd command looks for a given user-entered string. The search is performed in the order in which the cdpathlines are entered in the ftpacessfile.

For example, if the following cdpathentries are in the ftpaccessfile,

cdpath /pub/redhat/

cdpath /pub/linux/

and the user types cd i386, the server searches for an entry in any defined aliases, first in the /pub/redhatdirectory and then in the /pub/linuxdirectory. If a large number of aliases are defined, it is recommended that symbolic links to the directories be created instead of aliases. Doing so reduces the amount of work on the FTP server and decreases the wait time for the user.

Structure of the shutdownFile

The shutdown command tells the server where to look for the shutdownmessage generated by the ftpshutcommand or by the user. The shutdowncommand is used with a pathname to a shutdown file, such as: