ftp-proxy(8)

📦
version 1.9.2.4 · 2 versions
, in debian bookworm, debian trixie, ubuntu jammy, ubuntu noble, ubuntu questing, ubuntu resolute, ubuntu stonking

💖 NAME 💖

okay bestie, welcome to ftp-proxy(8) — this is the manual for ftp-proxy, an application level proxy for the FTP protocol. yes, the FTP protocol. we're going there. 🦋

✨ SYNOPSIS ✨

ftp-proxy [-c] [-d|-i] [-f file] [-n] [-v level] [-V]

that's the whole summoning ritual, no cap. 💅

🌸 DESCRIPTION 🌸

okay so picture this: FTP-Proxy is literally an application level gateway sitting between FTP clients and FTP servers. it's the middle bestie. the vibe translator. the bouncer at the door. 🫶

its main character purpose? securing local FTP servers against possibly insecure clients or straight-up malicious attacks. and ngl, FTP-Proxy is believed to be immune against current known attacks based on the FTP protocol — that's iconic behavior, we love to see it. 👑

and the way that it can start?? two whole modes, bestie:

  • started from the inetd (or xinetd, or any other) internet super daemon, OR
  • executed on its own as a standalone daemon — in which case it will fork child processes to handle connections. so many little babies. 💀

which one happens depends on the ftp-proxy.conf(5) configuration option ServerType, or on the -i and -d command line switches — and heads up, those two switches take precedence over the config file. they said "we don't care what the config says" fr fr. ✨

FTP-Proxy also features a rich set of auditing and command restriction capabilities, and it's specifically suited for deployment in firewall environments. firewall girlies, this one's for you. 🔥

🎀 OPTIONS 🎀

  • -V — prints the program's version information and then bails with exit code 0. quick little "who am i" moment. 💖
  • -c — reads the configuration file, dumps its contents sorted by section and option name to standard output, and exits with code 0. mostly interesting for diagnostic purposes — aka a peek-under-the-hood situation. 🙈
  • -d — forces FTP-Proxy to run in standalone (daemon) mode, even if there's a ServerType inetd directive sitting right there in the config file. sorry config, we override you. 💅
  • -i — forces FTP-Proxy to run in inetd mode, even if the config file says ServerType standalone. the reverse override. symmetry, we love her. ✨
  • -f filename — specify an alternate configuration file to be read instead of the standard /etc/proxy-suite/ftp-proxy.conf file.

okay so important note bestie: the default path for the configuration file is a compile time option. it can be changed using the --prefix and --sysconfdir options when running the configure script — see also the INSTALL file for usage description. 📝

  • -n — do not detach from the controlling terminal. this prevents the default of becoming a daemon, and it is ignored if running in inetd mode. the main purpose of this option is to support the AIX System Resource Controller or similar setups, where several daemons are controlled by a master daemon. middle management, basically. 💀
  • -v level — enable diagnostic output to be sent to the file /tmp/ftp-proxy.debug. the given level must be in the range from 0 (no output at all) to 4 (maximum verbosity). see also DIAGNOSTICS below. 📢

🦋 SIGNALS 🦋

  • SIGTERM, SIGQUIT, SIGINT — these signals instruct FTP-Proxy to abort any existing transfer, close all connections and terminate the process. and if the target of the signal is a running FTP-Proxy daemon, all current child processes will also be terminated. it's giving "we're all going down together." 😭
  • SIGHUP — this signal will be accepted if running in daemon mode and ignored in inetd mode.

it causes FTP-Proxy to reread its configuration file and to reopen the log destination if it was changed in the configuration file, or rotated if it is a log file.

see also the dedicated rotation signal SIGUSR1 below. 🌈

  • SIGUSR1 — this signal will be accepted if running in daemon mode and ignored in inetd mode.

it causes FTP-Proxy to close its current logfile, rename it to a date and time derived value, and open a new logfile. this procedure is also known as Logfile Rotation. ✨ child processes forked before the reception of this signal and processes run from inetd will not be affected.

see also the ServerRoot configuration option in ftp-proxy.conf(5). 💜

💜 NOTES 💜

when running FTP-Proxy in inetd mode, it is always an excellent idea to check that the inetd configuration file includes a line that invokes FTP-Proxy. here's an example for a line in /etc/inetd.conf:

ftp stream tcp nowait root /usr/sbin/ftp-proxy -i
⚠️ bestie please note that this is just an example and does not provide much security, like running as a non-privileged user or using the TCP Wrapper functionality. do not copy-paste-and-vibe, okay? 🫶

🔥 DIAGNOSTICS 🔥

the -v option is only available if enabled using the --enable-debug option when running the configure script — see also the INSTALL file for usage description. this option should be used with great care only. it is strongly recommended to not use it in production environments. like, at all. nope. 🙅

if debugging is activated, it always adds output to the file /tmp/ftp-proxy.debug which is created with 0666 mode. this allows child processes to open and write the file after they have given up their root privileges. yes, that's the whole point, no cap. 👑

if the configuration file contains a ServerRoot directive, child processes and processes run from inetd will try to open the file within their chroot(2) environment. if this fails — e.g. because there is no /tmp directory — it is silently ignored and no debug output is generated. it just… doesn't happen. no drama, no error. 💀

🚨 okay this one is important: the program makes no attempt to erase the debug file after use. thus it will stay around with world writeability until the operator manually removes it! so bestie, please go remove it yourself. the program is not gonna do it for you. periodt. 💅

🌈 FILES 🌈

  • /etc/proxy-suite/ftp-proxy.conf
  • /usr/sbin/ftp-proxy

⭐ SEE ALSO ⭐

  • ftp-proxy.conf(5)
  • The SuSE Proxy-Suite documentation included in the doc subdirectory of the package. 📚

👑 AUTHORS 👑

  • Jens-Gero Boehm <jens-gero.boehm@suse.de>
  • Pieter Hollants <pieter.hollants@suse.de>
  • Volker Wiegand <volker.wiegand@suse.de>
  • Marius Tomaschewski <mt@suse.de>

the icons themselves. we stan. 💖

the whole SuSE Proxy-Suite is released under the GNU General Public License (GPL). ✨

and that's the whole page bestie!! this one came from SuSE, dated September 20th, 1999 — an absolute vintage icon, fr fr. go forth and proxy responsibly 🦋💅💖

📦 where this page comes from