HOWTO - Anonymous FTP Set Up

---

---

This ``howto'' gives the details on how to set-up anonymous ftp for your Un*x machine (specific details are for Linux, but are generally applicable). The assumption is that ftp is already enabled. If not then check the following files and modify them accordingly:

• /etc/services - make sure the ftp service exists with a line like:

  ftp             21/tcp

• /etc/inetd.conf - establish ftp as a inetd service. Should have a line like :
  

  ftp     stream  tcp     nowait  root    /usr/sbin/tcpd  wu.ftpd

  (see the inetd.conf(5), hosts_access(5), & tcpd(8) man pages)
• /etc/ftpaccess - make sure that it exists and gives the appropriate access to real users as well as anonymous.
  (see the ftpaccess(5) man page)
• /etc/ftpusers - to disallow ftp access to certain privilege users, such as: root, uucp, and news. This is done by listing them, one user per line.
  (see the ftpd(8) man page)
• /etc/ftpconversions - maps how conversions are carried out (e.g. .tar.gz <-> .tar, etc.)
  (see the ftpconversions(5) man page)

Setting up anonymous ftp

• add ftp as a user with a home directory, but no shell and no password to disallow any type of shell login. The uid & gid need to follow the usual rules for accounts.
  /etc/passwd:

  ftp:*:400:400::/u/ftp:/bin/false

  /etc/group:

  ftp::400:root,bin,src,rk

• Change to the ftp home directory (cd ~ftp) and create the directories (etc, bin, pub, lib) with restricted permissions and ownership
  

  	mkdir etc bin pub lib
  	chmod 755 etc bin pub lib .
  	chown root.root etc bin pub lib .
  

• Anonymous ftp attempts to make things more secure by using the chroot mechanism which changes the root to something lower in the directory tree. This requires that some of the system files need to be copied to this ``new'' root.
  Copy & edit the system /etc/passwd & /etc/group to ~ftp/etc. Strip them to the bare-bones. Remember any anonymous ftp user can read these.
  ~ftp/etc/passwd:

  root:*:0:0:root:/root:/bin/csh
  bin:*:1:1:bin:/bin:
  adm:*:3:4:adm:/var/adm:
  ftp:*:400:400::/u/ftp:/bin/false
  

  ~ftp/etc/group:

  root::0:root
  bin::1:root,bin,daemon
  daemon::2:root,bin,daemon
  sys::3:root,bin,adm
  adm::4:root,adm,daemon
  mail::12:mail
  news::13:news
  uucp::14:uucp
  man::15:man
  src::16:root,bin,src
  ftp::400:root,bin,src
  

  Once they have been created, give these files only read access with:

  	cd ~ftp/etc
  	chmod 444 *
  

• ftp uses a single executable, ``ls'', which is probably dynamically linked to a run-time library. The following assumes some version, which should be modified for your own set-up.
  Discover the dynamically loaded library
  

  	ldd /bin/ls
  

  Copy over the executable and library

  	umask 022
  	cp /bin/ls ~ftp/bin
  	cp /lib/libc.so.5.3.12 ~ftp/lib
  	cp /lib/ld.so ~ftp/lib
  	cd ~ftp/lib
  	ln -s libc.so.5.3.12 libc.so.5
  

• Experience has shown that using the dynamically linked ``ls'' doesn't work in all cases. (It did work for Linux when it used the a.out format of executables. It does not work under the Linux ELF format.) The following section describes the ``easiest'' path to create a statically linked ls executable.
  1. The first thing to do is to grab the latest GNU file utilities collection. The closest & readily available anonymous ftp site is ftp://ftp.cdrom.com/pub/gnu/fileutils-3.16.tar.gz.
  2. unzip it & and un-tar it somewhere:
     

     	tar -xzvf fileutils-3.16.tar.gz
       

  3. Go into that directory and execute

     	cd fileutils-3.16
     	./configure
       

  4. Go into the library directory and build the library

     	cd lib
     	make
       

  5. Enter into the source directory and build only the ls utility with static linking. (The example assumes the GNU gcc compiler & loader is being used. Substitute the appropriate loader command for your system.)

     	cd ../src
     	make LDFLAGS=-static ls
       

  6. test it with ldd to make sure it's statically loaded and that it executes correctly with ./ls

  If everything works out, the ~ftp/lib can be eliminated once the statically linked ls is moved to ~ftp/bin.

• Add allowed user directorys to pub, with the appropriate permissions and ownership

  	cd ~ftp/pub
  	mkdir rk
  	chown rk.owen rk
  	chmod 755 rk
  

If all these steps are successful, you should now have a fully functional anonymous ftp site. User rk will have a directory ~ftp/pub/rk where he can make any file publically available he desires.

---

Last Modified:

---

---

Brought to you by: R.K. Owen,Ph.D.
This page is http://owen.sj.ca.us/rkowen/howto/anonftp.html