NAME¶
ftp-proxy - application level proxy for the FTP protocol
SYNOPSIS¶
ftp-proxy [-c] [-d|-i] [-f file] [-n] [-v level] [-V]
DESCRIPTION¶
FTP-Proxy acts as an application level gateway between FTP clients and
servers. Its main purpose is to secure local FTP servers against possibly
insecure clients or malicious attacks. FTP-Proxy is believed to be immune
against current known attacks based on the FTP protocol.
FTP-Proxy can be started from the inetd (or xinetd, or any other) internet super
daemon or executed on its own as a standalone daemon, in which case it will
fork child processes to handle connections. The behaviour depends on the
ftp-proxy.conf(5) configuration option
ServerType or the
-i and
-d command line switches, where the latter two take
precedence.
FTP-Proxy features a rich set of auditing and command restriction capabilities
and is specifically suited for deployment in firewall environments.
OPTIONS¶
- -V
- Print the program's version information and terminate with
exit code 0.
- -c
- Read the configuration file, output its contents sorted by
section and option name to standard output, and terminate with exit code
0. This option is mostly interesting for diagnostic purposes.
- -d
- Force FTP-Proxy to run in standalone (daemon) mode, even if
a ServerType inetd directive exists in the configuration file.
- -i
- Force FTP-Proxy to run in inetd mode, even if a
ServerType standalone directive exists in the configuration
file.
- -f filename
- Specify an alternate configuration file to be read instead
of the standard /etc/proxy-suite/ftp-proxy.conf file.
Please note that the default path for the configuration file is a compile
time option. It can be changed using the --prefix and
--sysconfdir options when running the configure script - see
also the INSTALL file for usage description.
- -n
- Do not detach from the controlling terminal. This prevents
the default of becoming a daemon and is ignored if running in inetd
mode. The main purpose of this option is to support the AIX System
Resource Controller or similar setups, where several daemons are
controlled by a master daemon.
- -v level
- Enable diagnostic output to be sent to the file
/tmp/ftp-proxy.debug. The given level must be in the range from 0
(no output at all) to 4 (maximum verbosity). See also DIAGNOSTICS
bellow.
SIGNALS¶
- SIGTERM, SIGQUIT, SIGINT
- These signals instruct FTP-Proxy to abort any existing
transfer, close all connections and terminate the process. If the target
of the signal is a running FTP-Proxy daemon, all current child processes
wil also be terminated.
- SIGHUP
- This signal will be accepted if running in daemon mode and
ignored in inetd mode.
It causes the FTP-Proxy to reread its configuration file and to reopen the
log destination if it was changed in the configuration file, or rotated if
it is a log file.
See also dedicated rotation singnal SIGUSR1 bellow.
- SIGUSR1
- This signal will be accepted if running in daemon mode and
ignored in inetd mode.
It causes the FTP-Proxy to close its current logfile, rename it to a date
and time derived value, and open a new logfile. This procedure is also
known as Logfile Rotation. Child processes forked before the
reception of this signal and processes run from inetd will not be
affected.
See also the ServerRoot configuration option in
ftp-proxy.conf(5).
NOTES¶
When running FTP-Proxy in
inetd mode, it is always an excellent idea to
check that the inetd configuration file includes a line that invokes
FTP-Proxy. An example for a line in
/etc/inetd.conf follows:
ftp stream tcp nowait root /usr/sbin/ftp-proxy -i
Please note that this is just an example and does not provide much security,
like running as a non-privileged user or using the
TCP Wrapper
functionality.
DIAGNOSTICS¶
The
-v option is is only available if enabled using the
--enable-debug option when running the configure script - see also the
INSTALL file for usage description. This option should be used with
great care only. It is strongly recommended to not to use it in production
environments.
If debugging is activated, it always adds output to the file
/tmp/ftp-proxy.debug which is created with
0666 mode. This
allows child processes to open and write the file after they have given up
their root privileges.
If the configuration file contains a
ServerRoot directive, child
processes and processes run from
inetd will try to open the file within
their
chroot(2) environment. If this fails, e.g. because there is no
/tmp directory, it is silently ignored and no debug output is
generated.
Please note that the program makes no attempt to erase the debug file after use.
Thus it will stay around with world writeability until the operator manually
removes it!
FILES¶
/etc/proxy-suite/ftp-proxy.conf
/usr/sbin/ftp-proxy
SEE ALSO¶
ftp-proxy.conf(5)
The
SuSE Proxy-Suite documentation included in the
doc
subdirectory of the package.
AUTHORS¶
Jens-Gero Boehm <jens-gero.boehm@suse.de>
Pieter Hollants <pieter.hollants@suse.de>
Volker Wiegand <volker.wiegand@suse.de>
Marius Tomaschewski <mt@suse.de>
COPYRIGHT¶
The whole
SuSE Proxy-Suite is released under the
GNU General Public License (GPL).