Owl River Company

1. Initially /bin/touch /var/log/ftpd /var/log/xferlog to ensure that logging will work
   
   
2. (pre RH 7.0) Edit /etc/inetd.conf ...
   

   [root@new ftpd-BSD]# grep ftp /etc/inetd.conf | grep -i -v tftp
   ## non-BSD ftp  stream  tcp     nowait  root    /usr/sbin/tcpd  in.ftpd -l -a
   ftp  stream  tcp  nowait  root  /usr/sbin/tcpd  ftpd-BSD -l -l -S -U -u 022
   

   (still pre RH 7.0) ... and HUP your inetd.
   
   

        kill -HUP ` ps ax | grep inet | grep -v grep | awk '{print $1}'`
   

   
       - or in a Red Hat environment:
   

        service inet restart
   

   
   
   
3. (RH 7.0 and following) Attend to getting xinetd working:
   

   [root@new ftpd-BSD]# cat /usr/local/bin/ftpd-BSD
   # default: on
   # description: The ftpd-BSD FTP server serves FTP connections. It uses \
   #       normal, unencrypted usernames and passwords for authentication.
   service ftp
   {
           disable = no
           socket_type             = stream
           wait                    = no
           user                    = root
           server                  = /usr/sbin/ftpd-BSD
           server_args             = -l -l -S -U -u 022
           log_on_success          += DURATION USERID
           log_on_failure          += USERID
           nice                    = 10
   }
   

   Copy ftpd-BSD to /etc/xinetd.d and put it in effect by:
   

       service xinetd restart
   

   
   
4. Please note that this may (should ?) break your tcp-wrappers. If you are using this product, you are probably interested in avoiding the morass of problems with wu-ftpd, and want to ride on the audit coattails of the OpenBSD folks. So, remember to run tcpdchk to catch such induced errors. Edit your /etc/hosts.allow and /etc/hosts.deny to fix them.
   
   
5. Then, attend to getting logs rotation working:
   

   [root@new ftpd-BSD]# cat /usr/local/bin/ftpd-logrotate
   /var/log/ftpd {
       missingok
       create 0664 root root 
   }
   
   /var/log/xferlog {
       missingok
       create 0664 root root 
   }
   [root@new ftpd-BSD]# 
   

   Copy ftpd-logrotate to /usr/local/bin, set its permissions thus: chmod 755 /usr/local/bin/ftpd-logrotate and put it in effect by:
   

      ln -s /usr/local/bin/ftpd-logrotate /etc/logrotate.d
   

   
   
6. SECURITY -- Please, install the /etc/ftpusers, /etc/ftpchroot and related access control files to taste from scratch, or cheat and copy a baseline from another install:
   
   /etc/ftpusers -- A userid listed here will be denied ftp access. Good candidates for inclusion: root, all daemon userids.
   
   /etc/ftpaccess -- Lots and lots of options -- no substitute for reading the man page.
   
   /etc/ftpchroot -- A userid listed here will be allowed ftp, but a chroot to their home directory will be performed after authentication. Good candidates for inclusion: all regular userids. Selectively REMOVE people to be afforded full host view access -- but counsel them about scp and rsync -av -e ssh first. See our script ORCchrootftp which should be placed into /usr/local/bin with permissions 0700, and run each hour thus:
   
   ln -s /usr/local/bin/ORCchrootftp /etc/cron.hourly
   
   An account with a shell NOT listed in /etc/shells will NOT be permitted FTP privileges. This is a feature in that it is an expected behaviour, and not a bug.
   
   
7. ... A wealth of information about the package is available when you RTFM on the ftpd-BSD man page. There is really no substitute for doing so.
   
   We could package some of the foregoing into the spec file, but by not doing so, are requiring the sysadmin to be thoughtful about security on this potentially dangerous (clear text passwords, history of buffer overruns) service. Once installed, do so thus:
   
   

       man 8 ftpd-BSD
   

   It offers the exact method, for example, to lock ordinary users in a 'chroot' jail of their own directory tree and no more.
   
   

 *      This product includes software developed by the University of 
 *      California, Berkeley and its contributors.