Libra FTP daemon - Internet Anonymous File Transfer Protocol Server
ftps [-r] [-p] [-lmodes] [-b] [-ccharset]
Libra is the Internet File Transfer Protocol server process.
The server is supposed to be started from listening servers, like inetd(8) or tcpserver(8). It expects the control connection to be redirected on stdin and stdout.
The FTP server will timeout an inactive session after 5 minutes. A client may also request a different timeout period; the maximum period is 5 minutes.
If the -r option is specified, the server will deny all "write" requests: create file, delete file, write to file, create directory, remove directory, change mode of file, change umask.
If the -p option is specified, the server will accept passive data connections only. It will send the following reply to all PORT commands: 502 Command not implemented. This mode allows to forbid proxy FTP functionaly which is vulnerable to bounce attack.
If the -l option is specified, the server will log events specified in modes. Log messages are written to the standard error device.
modes can be one or more of following values:
If the -l option isn't specified the server will log error and warning messages only.
Libra will send the content of the .message file (if present) when:
If the -b option is specified the server won't send a Wellcome greeting to the peer. This is usefull if it works as "back-end" server. Front-end server does the authentication and then lets Libra to process the rest of the session. In this case Wellcome message is already sent by the front-end server. Sending another greetings from Libra will definitelky confuse a FTP client. There is an implementation of a PNIAM-aware front-end server from Alexander A. Naumov (email@example.com). For more information about PNIAM see http://www.msu.ru/pniam/pniam.html.
Every pathname consisting of ASCII (7bit) characters only is sent via control connection as is. Pathnames containing characters in local (8bit) encoding are sent as UNICODE characters using UTF-8 encoding rules. Using the -c option you should specify the conversion table from local character set to UNICODE. charset has a very simple format. Every line specifies conversion of one character. It consists of a pair local character - UNICODE.
The FTP server currently supports the following FTP commands; case is not distinguished.
abort file transfer
specify account (ignored)
allocate storage (vacuously)
append to a file
change to parent of current working directory
change working directory
delete a file
extended specification of data connection address (IPv4 and IPv6)
force server to open data connection (IPv4 and IPv6)
give help information
list the content of directory in ls-like format
make a directory
specify data transfer mode
list names of files in a directory
specify password (ignored)
force server to open data connection
specify data connection address
print the current working directory
restart incomplete transfer
retrieve a file
remove a directory
specify rename-from file name
specify rename-to file name
non-standard commands (see next section)
return status of server
store a file
store a file with a unique name
specify data transfer structure
show operating system type of server system
specify data transfer type
specify user name (ignored)
change to parent of current working directory (deprecated)
change working directory (deprecated)
make a directory (deprecated)
print the current working directory (deprecated)
remove a directory (deprecated)
The remaining FTP commands specified in Internet RFC 959 are recognized, but not implemented.
Following commands are RFC pending.
show last modification time of path
list the content of directory in machine-readable format (experimental)
return the information about the given object in machine-readable format (experimental)
return transfer size of path for TYPE L(ocal byte size) 8(bits), MODE S(tream), STRU F(ile)
Following non-standard or UNIX-specific commands are supported by the SITE request.
toggle the computation of checksums during the file transfer. The checksum is reported in the 226 final response. The MD5 algorithm is used for computation of checksums. Checksum is computed based on the file content on the server side. Files are stored on the server as sequence of 8-bit bytes. End of line is denoted by a single newline character (ASCII code 10).
change mode of a file. E.g.
SITE CHMOD 755 filename
set idle-timer. E.g.
SITE IDLE 60
list files newer than a particular date
same as SITE NEWER
change umask. E.g.
SITE UMASK 002
The FTP server does not require any authentification. Sending user name and password is optional.
The FTP server does not have to run as a superuser. It does not open privileged ports.
Libra does not implement any server-side filename filtering in LIST and NLST commands. We've decided to abandon to filter out files because it creates possibilities for denial-of-service (DoS) attacks. The other consequence of this decision is that mget command in standard ftp client won't work, because it relies upon this server feature.
The server does not support the ability to restart broken transfer (REST) in ASCII transfer mode (TYPE A). The restart position is given in client-side bytes forcing the server to calculate the number of new lines in the file and introducing another DoS attack possibility (high CPU comsumption for the server by zero cost for the client).
Libra is supposed to be started by any listening server, like inetd(8) or tcpserver(8). It expects its standard input and output (file descriptors 0 and 1) to be the FTP control connection socket (however, for your fun, you may run the server with input and output on a terminal).
Files sent with the STOR command are created with default permissions. The user can change this behavior with SITE UMASK command.
The FTP server will abort an active file transfer only when the ABOR command is preceded by a Telnet "Interrupt Process" (IP) signal and a Telnet "Synch" signal in the command Telnet stream, as described in Internet RFC 959. If a STAT command is received during a data transfer, preceded by a Telnet IP and Synch, transfer status will be returned.
Libra consists of a single file - ftps. It does not require any additional files and devices.
Here is a very simple installation scenario:
ftp stream tcp nowait user script name
Libra includes native support for IPv6. The server implements EPRT and EPSV commands as specified in RFC 2428 FTP Extensions for IPv6 and NATs. Thus it is possible to request or open data connection using an IPv6 address. This address family is also supported in various places where output of node address is required, for example in STAT command.
FTP clients working in IPv4 mode can still send PORT and PASV to server working in IPv6 mode.
Following scenarios are supported:
Andrey Savochkin (firstname.lastname@example.org), Maxim Shesterikov (email@example.com). The current maintainer is Maxim Shesterikov.
ftp(1), inetd(8), ``Approaches of Libra FTP daemon development''