ftpaccess.5

wu-ftpd类unix下的ftp服务器,可用于嵌入式系统

.\"
.\" Copyright (c) 1999,2000 WU-FTPD Development Group. 
.\" All rights reserved.
.\" 
.\" Portions Copyright (c) 1980, 1985, 1988, 1989, 1990, 1991, 1993, 1994 
.\" The Regents of the University of California.  Portions Copyright (c) 
.\" 1993, 1994 Washington University in Saint Louis.  Portions Copyright 
.\" (c) 1996, 1998 Berkeley Software Design, Inc.  Portions Copyright (c) 
.\" 1998 Sendmail, Inc.  Portions Copyright (c) 1983, 1995, 1996, 1997 Eric 
.\" P. Allman.  Portions Copyright (c) 1989 Massachusetts Institute of 
.\" Technology.  Portions Copyright (c) 1997 Stan Barber.  Portions 
.\" Copyright (C) 1991, 1992, 1993, 1994, 1995, 1996, 1997 Free Software 
.\" Foundation, Inc.  Portions Copyright (c) 1997 Kent Landfield. 
.\"
.\" Use and distribution of this software and its source code are governed 
.\" by the terms and conditions of the WU-FTPD Software License ("LICENSE"). 
.\"
.\"     $Id: ftpaccess.5,v 1.24 2000/07/01 17:49:09 wuftpd Exp $
.\"
.TH ftpaccess 5
.SH Name

ftpaccess \- ftpd configuration file

.SH Description

The ftpaccess file is used to configure the operation of
.BR ftpd(8) .

.SH Access Capabilities

.TP 0.5i
.B autogroup <groupname> <class> [<class> ...]

If an ANONYMOUS user is a member of any of <class>, the ftp server will
perform a setegid() to <groupname>.  This allows access to
group-and-owner-read-only files and directories to a particular class of
anonymous users. <groupname> is a valid group from /etc/group (or wherever
mechanism your
.IR getgrent(2)
library routine uses).

.TP 0.5i
.B class <class> <typelist> <addrglob> [<addrglob> ...]

Define <class> of users, with source addresses of the form <addrglob>.
Multiple members of <class> may be defined.  There may be multiple "class"
commands listing additional members of the class.  If multiple "class"
commands can apply to the current session, the first one listed in the
access file is used.  Failing to define a valid class for a host will cause
access to be denied.  <typelist> is a comma-separated list of any of the
keywords "anonymous", "guest" and "real".  If the "real" keyword is
included, the class can match users using FTP to access real accounts, and
if the "anonymous" keyword is included the class can match users using
anonymous FTP.  The "guest" keyword matches guest access accounts (see
"guestgroup" for more information)

<addrglob> may be a globbed domain name or a globbed numeric address.  It
may also be the name of a file, starting with a slash ('/'), which contains
additional address globs, as well as in the form address:netmask or
address/cidr.

Placing an exclamation (!) before an <addrglob> negates the test.  For
example:
.nf
    class rmtuser real !*.example.com
.fi
will classify real users from outside the example.com domain as the class
rmtuser.  Use care with this option.  Remember, the result of each test is
OR'ed with other tests on the line.

.TP 0.5i
.B deny <addrglob> <message_file>

Always deny access to host(s) matching <addrglob>.  <message_file> is
displayed.  <addrglob> may be "!nameserved" to deny access to sites without
a working nameserver.  It may also be the name of a file, starting with a
slash ('/'), which contains additional address globs, as well as in the
form address:netmask or address/cidr.

.TP 0.5i
.B guestgroup <groupname> [<groupname> ...]
.TP 0.5i
.B guestuser <username> [<username> ...]
.TP 0.5i
.B realgroup <groupname> [<groupname> ...]
.TP 0.5i
.B realuser <username> [<username> ...]

For guestgroup, if a REAL user is a member of any of <groupname>, the
session is set up exactly as with anonymous FTP.  In other words, a
chroot() is done, and the user is no longer permitted to issue the USER and
PASS commands.  <groupname> is a valid group from /etc/group (or whatever
mechanism your
.IR getgrent(3)
library routine uses).

The user's home directory must be properly set up, exactly as anonymous FTP
would be.  The home directory field of the passwd entry is divided into two
directories.  The first field is the root directory which will be the
argument to the
.IR chroot(2)
call.  The second half is the user's home directory relative to the root
directory.  The two halves are separated by a "/./".

For example, in /etc/passwd, the real entry:
.nf
    guest1:<passwd>:100:92:Guest Account:/ftp/./incoming:/etc/ftponly
.fi
When guest1 successfully logs in, the ftp server will
.BR chroot("/ftp")
and then
.BR chdir("/incoming") .
The guest user will only be able to access the directory structure under
.BR /ftp
(which will look and act as / to guest1), just as an anonymous FTP user would.

The group name may be specified by either name or numeric ID.  To use a
numeric group ID, place a '%' before the number.  Ranges may be given.  Use
an asterisk to mean all groups.

guestuser works like guestgroup, except uses the user name (or numeric ID).

realuser and realgroup have the same syntax, but reverse the effect of
guestuser and guestgroup.  They allow real user access when the remote user
would otherwise be determined a guest.

For example:
.nf
    guestuser *
    realgroup admin
.fi
causes all non-anonymous users to be treated as guest, with the sole
exception of users in the admin group who are granted real user access.

.TP 0.5i
.B nice <nice-delta> [<class>]

Adjust the process nice value of the ftpd server process by the indicated
<nice-delta> value if the remote user is a member of the named <class>.  If
<class> is not specified, then use <nice-delta> as the default adjustment
to the ftpd server process nice value.  This default nice value adjustment
is used to adjust the nice value of the server process only for those users
who do not belong to any class for which a class-specific `nice' directive
exists in the ftpaccess file.

.TP 0.5i
.B defumask <umask> [<class>]

Set the umask applied to files created by daemon if the remote use is a
member of the named class.  If <class> is not specified, then use the umask
as the default for classes which do not have one specified.

.TP 0.5i
.B tcpwindow <size> [<class>]

Set the TCP window size for the data connection.  This can be used to
control network traffic.  For instance, slow PPP dialin links may need
smaller TCP windows to speed up throughput.  If you don't know what this
does, don't play with it.

.TP 0.5i
.B keepalive <yes|no>

Set the TCP SO_KEEPALIVE option for data sockets.  This can be used to control
network disconnect.  Yes: set it.  No: use system default (usually off).  You
probably want to set this.

.TP 0.5i
.B timeout accept <seconds>
.TP 0.5i
.B timeout connect <seconds>
.TP 0.5i
.B timeout data <seconds>
.TP 0.5i
.B timeout idle <seconds>
.TP 0.5i
.B timeout maxidle <seconds>
.TP 0.5i
.B timeout RFC931 <seconds>

Set various timeouts.

Accept (default 120 seconds): how long the daemon will wait for an incoming
(PASV) data connection.

Connect (default 120 seconds): how long the daemon will wait attempting to
establish an outgoing (PORT) data connection.  This effects the actual
connetion attempt.  The daemon makes several attempts, sleeping a while
between each, before completely giving up.

Data (default 1200 seconds): how long the daemon will wait for some
activity on the data connection.  You should keep this long because the
remote client may have a slow link and there can be quite a bit of data
queued for the client.

Idle (default 900 seconds): how long the daemon will wait for the next
command.  The default can also be overridden by the command line -a option.
This access clause overrides both.

MaxIdle (default 1200 seconds): the SITE IDLE command allows the remote
client to establish a higher value for the idle timeout.  This sets the
upper limit the client may request.  The default can also be overridden by
the command line -A option.  This access clause overrides both.

RFC931 (default 10 seconds): the maximum time the daemon allows for the
entire RFC931 (AUTH/ident) conversation.  Setting this to zero (0)
completely disables the daemon's use of this protocol.  The information
obtained via RFC931 is recorded in the system logs and not actually used in
any authentication.

.TP 0.5i
.B file-limit [<raw>] <in|out|total> <count> [<class>]

Limit the number of data files a user in the given class may transfer.  The
limit may be placed on files in, out or total.  If no class is specified,
the limit is the default for classes which do not have a limit specified.
The optional
.B raw
parameter applies the limit to the total traffic rather than just data
files.

.TP 0.5i
.B data-limit [<raw>] <in|out|total> <count> [<class>]

Limit the number of data bytes a user in the given class may transfer.  The
limit may be place on bytes in, out or total.  If no class is specified,
the limit is the default for classes which do not have a limit specified.
The optional
.B raw
parameter applies the limit to total traffic rather than just data files.

.TP 0.5i
.B limit-time {*|anonymous|guest} <minutes>

Limit the total time a session can take.  By default, there is no limit.
Real users are never limited.

.TP 0.5i
.B guestserver [<hostname>]

Controls which hosts may be used for anonymous or guest access.  If used
without <hostname>, denies all guest or anonymous access to this site.
More than one <hostname> may be specified.  Guest and anonymous access will
only be allowed on the named machines.  If access is denied, the user will
be asked to use the first <hostname> listed.

.TP 0.5i
.B limit <class> <n> <times> <message_file>

Limit <class> to <n> users at times <times>, displaying <message_file> if
the user is denied access.  Limit check is performed at login time only.
If multiple "limit" commands can apply to the current session, the first
applicable one is used.  Failing to define a valid limit, or a limit of -1,
is equivalent to unlimited. <times> is in same format as the times in the
UUCP L.sys file.

.TP 0.5i
.B noretrieve [absolute|relative] [class=<classname>] ... [-] <filename> <filename> ...

Always deny retrieve-ability of these files.  If the files are a path
specification (i.e. begins with '/' character) then only those files are marked
un-gettable, otherwise all files with matching the filename are refused
transfer.  For example:
.nf
    noretrieve /etc/passwd core
.fi
specifies no one will be able to get the file /etc/passwd whereas they will
be allowed to transfer a file `passwd' if it is not in /etc. On the other
hand no one will be able to get files named `core' wherever they are.

Directory specifications mark all files and sub-directories in the named
directory un-gettable.  The <filename> may be specified as a file glob.  For
example:
.nf
    noretrieve /etc /home/*/.htaccess
.fi
specified no files in /etc or any of its sub-directories may be retrieved.
Also, no files named '.htaccess' anywhere under the /home directory may be
retrieved.

The optional first parameter selects whether names are intepreted as
absolute or relative to the current chroot'd environment.  The default is
to intepret names beginning with a slash as absolute.

The noretrieve restrictions may be placed upon members of particular
classes.  If any class= is specified the named files are only
non-retrievable if the current user is a member of any of the given
classes.

.TP 0.5i
.B allow-retrieve [absolute|relative] [class=<classname>]... [-] <filename> ...

Allows retrieval of files which would otherwise be denied by noretrieve.

.TP 0.5i
.B loginfails <number>

After <number> login failures, log a "repeated login failures" message and
terminate the FTP connection.  Default value is 5.

.TP 0.5i
.B private <yes|no>

After user logs in, the SITE GROUP and SITE GPASS commands may be used to
specify an enhanced access group and associated password.  If the group
name and password are valid, the user becomes (via setegid()) a member of
the group specified in the group access file /etc/ftpgroups.

The format of the group access file is:
.nf
    access_group_name:encrypted_password:real_group_name
.fi
where access_group_name is an arbitrary (alphanumeric + punctuation)
string.  encrypted_password is the password encrypted via
.IR crypt(3) ,
exactly like in
.BR /etc/passwd .
.B real_group_name
is the name of a valid group listed in
.BR /etc/group .

NOTE: For this option to work for anonymous FTP users, the ftp server must
keep
.B /etc/group
permanently open and the group access file is loaded into memory.  This
means that (1) the ftp server now has an additional file descriptor open,
and (2) the necessary passwords and access privileges granted to users via
SITE GROUP will be static for the duration of an FTP session.  If you have
an urgent need to change the access groups and/or passwords *NOW*, you just
kill all of the running FTP servers.

.SH Informational Capabilities

.TP 0.5i
.B greeting full|brief|terse
.TP 0.5i
.B greeting text <message>

Allows you to control how much information is given out before the remote
user logs in.  'greeting full' is the default and shows the hostname and
daemon version.  'greeting brief' whose shows the hostname.  'greeting
terse' simply says "FTP server ready."  Although full is the default, brief
is recommended.

The 'text' form allows you to specify any greeting message you desire.
<message> can be any string; whitespace (spaces and tabs) is converted to a
single space.

.TP 0.5i
.B banner <path>

Works similarly to the message command, except that the banner is displayed
before the user enters the username/password.  The <path> is relative to
the real system root, not the base of the anonymous FTP directory.

.B WARNING:
use of this command can completely prevent non-compliant FTP clients from
making use of the FTP server.  Not all clients can handle multi-line
responses (which is how the banner is displayed).

.TP 0.5i
.B hostname <some.host.name>

Defines the default host name of the ftp server.  This string will be
printed on the greeting message and every time the %L magic cookie is used.
The host name for virtual servers overrides this value.  If not specified,
the default host name for the local machine is used.

.TP 0.5i
.B email <name>

Defines the email address of the ftp archive maintainer.  This string will
be printed every time the %E magic cookie is used.

.TP 0.5i
.B message <path> {<when> {<class> ...}}

Define a file with <path> such that ftpd will display the contents of the
file to the user login time or upon using the change working directory
command.  The <when> parameter may be "LOGIN" or "CWD=<dir>".  If <when> is
"CWD=<dir>", <dir> specifies the new default directory which will trigger
the notification.

The optional <class> specification allows the message to be displayed only