GLOBUS-GRIDFTP-SER(8)

hey bestie 💖 you've landed on GLOBUS-GRIDFTP-SER(8), fresh out of the Grid Community Toolkit Manual, and it is so much server. buckle up, we're doing this in three parts and this is part one 🎀

✨ NAME ✨

globus-gridftp-server — the Globus GridFTP server daemon. that's it, that's the girl. 👑

---

✨ SYNOPSIS ✨

globus-gridftp-server OPTIONS

---

✨ DESCRIPTION ✨

okay so globus-gridftp-server is an ftp server, but not a basic one — she supports the GridFTP protocol extensions, and that means strong authentication, parallel data transfers, and parallel data layouts. all three. main character behaviour, no cap. 💅✨

---

✨ OPTIONS ✨

the list below is every command-line option the server takes, and also the name of the configuration file entry that implements that same option, because they're twins basically. 👯

🫶 heads up: any boolean option can be negated on the command line by putting -no- or -n in front of it. example: -no-cas or -nf. so yes, you can say "not that" and she'll listen.

🌸 Informational Options

• -h, -help — show usage information and exit. config file name: help. default: FALSE.
• -hh, -longhelp — show more usage information and exit. the deluxe version. config file name: longhelp. default: FALSE.
• -v, -version — show version info for the server and exit. config file name: version. default: FALSE.
• -V, -versions — show version info for all loaded globus libraries and exit. every single one. config file name: versions. default: FALSE.

🦋 Modes of Operation

• -i, -inetd — run under an inetd service. config file name: inetd. default: FALSE.
• -s, -daemon — run as a daemon. all connections will fork off a new process and setuid if allowed. config file name: daemon. default: TRUE.
• -S, -detach — run as a background daemon detached from any controlling terminals. she's free, she's independent 💅 config file name: detach. default: FALSE.
• -ssh — run over a connected ssh session. config file name: ssh. default: FALSE.
• -exec string — for statically compiled or non-GLOBUS_LOCATION standard binary locations, specify the full path of the server binary right here. only needed when run in daemon mode. config file name: exec.
• -chdir — change directory when the server starts. this will change directory to the dir specified by the chdir_to option. config file name: chdir. default: TRUE.
• -chdir-to string — directory to chdir to after starting. will use / if not set. note that this is the directory of the process, not the client's home directory. config file name: chdir_to.
• -threads number — enable threaded operation and set the number of threads. the default is 0, which is non-threaded. when threading is required, a thread count of 1 or 2 should be sufficient. config file name: threads.
• -f, -fork — server will fork for each new connection. disabling this option is only recommended when debugging. note that non-forked servers running as root will only accept a single connection, and then exit. config file name: fork. default: TRUE.
• -1, -single — exit after a single connection. one and done, iconic. config file name: single. default: FALSE.
• -chroot-path string — path to become the new root after authentication. this path must contain a valid certificate structure, /etc/passwd, and /etc/group. the command globus-gridftp-server-setup-chroot can help create a suitable directory structure. config file name: chroot_path.

🔐 Authentication, Authorization, and Security Options

• -auth-level number — add levels together to use more than one. if not set, uses level 2 for front ends and level 1 for data nodes. note that levels 2 and 4 imply level 1 as well.
  • 0 = disables all authorization checks.
  • 1 = authorize identity.
  • 2 = authorize all file/resource accesses.
  • 4 = disable changing process uid to authenticated user (no setuid) — DO NOT use this when the process is started as root.

config file name: auth_level.

• -process-user string — user to setuid to upon login for all connections. only applies when running as root. config file name: process_user.
• -process-group string — group to setgid to upon login for all connections. if unset, the default group of process_user will be used. config file name: process_group.
• -ipc-allow-from string — only allow connections from these source ip addresses. specify a comma separated list of ip address fragments. a match is any ip address that starts with the specified fragment. example: 192.168.1. will match and allow a connection from 192.168.1.45. note that if this option is used, any address not specifically allowed will be denied. config file name: ipc_allow_from.
• -ipc-deny-from string — deny connections from these source ip addresses. specify a comma separated list of ip address fragments. a match is any ip address that starts with the specified fragment. example: 192.168.2. will match and deny a connection from 192.168.2.45. config file name: ipc_deny_from.
• -allow-from string — only allow connections from these source ip addresses. specify a comma separated list of ip address fragments. a match is any ip address that starts with the specified fragment. example: 192.168.1. will match and allow a connection from 192.168.1.45. note that if this option is used, any address not specifically allowed will be denied. config file name: allow_from.
• -deny-from string — deny connections from these source ip addresses. specify a comma separated list of ip address fragments. a match is any ip address that starts with the specified fragment. example: 192.168.2. will match and deny a connection from 192.168.2.45. config file name: deny_from.
• -encrypt-data — require encrypted data channels. this will cause an error and prevent all transfers in which the client does not request an authenticated and encrypted data channel. no exceptions bestie 😭 config file name: encrypt_data. default: FALSE.
• -si, -secure-ipc — use GSI security on the ipc channel. config file name: secure_ipc. default: TRUE.
• -ia string, -ipc-auth-mode string — set GSI authorization mode for the ipc connection. options are: none, host, self or subject:[subject]. config file name: ipc_auth_mode. default: host.
• -aa, -allow-anonymous — allow clear text anonymous access. if the server is running as root, anonymous_user must also be set. disables ipc security. config file name: allow_anonymous. default: FALSE.
• -anonymous-names-allowed string — comma separated list of names to treat as anonymous users when allowing anonymous access. if not set, the default names of anonymous and ftp will be allowed. use * to allow any username. config file name: anonymous_names_allowed.
• -anonymous-user string — user to setuid to for an anonymous connection. only applies when running as root. config file name: anonymous_user.
• -anonymous-group string — group to setgid to for an anonymous connection. if unset, the default group of anonymous_user will be used. config file name: anonymous_group.
• -sharing-dn string — allow sharing when using the supplied DN. a client connected with these credentials will be able to access any user for which sharing is enabled. config file name: sharing_dn.
• -sharing-state-dir string — full path to a directory that will contain files used by GridFTP to control sharing access for individual local accounts. the special variables $HOME and $USER can be used to create a dynamic path that is unique to each local account. this path must be writable by the associated account. the default path is $HOME/.globus/sharing/. this must refer to a path on the filesystem, not a path that is only accessible via a DSI plugin. config file name: sharing_state_dir.
• -sharing-control — allow a local user account to control its own sharing access via special GridFTP client commands. the user account must have filesystem write access to the sharing state dir. config file name: sharing_control. default: TRUE.
• -sharing-rp string — sharing specific path restrictions. this completely replaces the normal path restrictions (-rp) when an account is being shared by a sharing-dn login. follows normal path restriction semantics. config file name: sharing_rp.
• -sharing-users-allow string — comma separated list of usernames that are allowed to share unless matched in the user deny lists. if this list is set, users that are not included will be denied unless matched in the group allow list. config file name: sharing_users_allow.
• -sharing-users-deny string — comma separated list of usernames that are denied sharing even if matched in the user or group allow lists. config file name: sharing_users_deny.
• -sharing-groups-allow string — a comma separated list of groups whose members are allowed to share, unless they got matched in the user or group deny lists first. Bestie, heads up: if you set this list at all, groups that aren't on it get denied unless they're matched in the user allow list. So it's an exclusive club, fr fr.

This option can also be set in the configuration file as sharing_groups_allow.

• -sharing-groups-deny string — comma separated list of groups whose members will be denied sharing, unless matched in the user allow list. 💅

This option can also be set in the configuration file as sharing_groups_deny.

• -allow-root — let clients get mapped to the root account. Yeah. The root account. 👑

This option can also be set in the configuration file as allow_root. The default value of this option is FALSE.

• -allow-disabled-login — skip the check on whether a user's system account is disabled before letting them log in.

This option can also be set in the configuration file as allow_disabled_login. The default value of this option is FALSE.

• -password-file string — turn on clear text access and authenticate users against this /etc/passwd formatted file.

This option can also be set in the configuration file as pw_file.

• -connections-max number — the max concurrent connections allowed. Only applies when you're running in daemon mode. Unlimited if you don't set it. ✨

This option can also be set in the configuration file as connections_max.

• -connections-disabled — disable ALL new connections. In daemon mode, send a SIGHUP to the server process after you change the config file so you don't mess with the connections that are already going.

This option can also be set in the configuration file as connections_disabled. The default value of this option is FALSE.

• -offline-msg string — a custom message shown to clients when the server is offline, like via the connections_disabled or connections_max = 0 options.

This option can also be set in the configuration file as offline_msg.

• -disable-command-list string — a comma separated list of client commands that will be disabled. Gone. Blocked. 🚫

This option can also be set in the configuration file as disable_command_list.

• -authz-callouts,-cas — enable the GSI authorization callout framework, for callouts such as CAS.

This option can also be set in the configuration file as cas. The default value of this option is TRUE.

• -use-home-dirs — set the starting directory to the authenticated user's home dir. Turning this off is literally the same as setting -home-dir /.

This option can also be set in the configuration file as use_home_dirs. The default value of this option is TRUE.

• -home-dir string — set a path to override the system defined home/starting directory for authenticated users. The special variable strings $USER and $HOME may be used. The authenticated username gets substituted for $USER, and the user's real home dir gets substituted for $HOME. Be sure to escape the $ character if you're using these on the command line, bestie. 🐚

This option can also be set in the configuration file as home_dir.

• -rp string, -restrict-paths string — a comma separated list of full paths that clients may access. Each path may be prefixed by R and/or W, denoting read or write access — otherwise full access is granted. If a given path is a directory, all contents and subdirectories get the same access. Order of paths does not matter — the permissions on the longest matching path will apply. The special character ~ will be replaced by the authenticated user's home directory, or the -home-dir option, if used. Note that if the home directory is not accessible, \~ will be set to /. By default all paths are allowed, and access control is handled by the OS. In a striped or split process configuration, this should be set on both the frontend and data nodes. 👑

This option can also be set in the configuration file as restrict_paths.

• -rp-follow-symlinks — don't verify that a symlink points to an allowed path before following it. By default, symlinks are followed only when they point to an allowed path. Enable this and symlinks get followed even if they point to a path that's otherwise restricted. 🙈

This option can also be set in the configuration file as rp_follow_symlinks. The default value of this option is FALSE.

• -em string, -acl string — a comma separated list of ACL or event modules to load.

This option can also be set in the configuration file as acl.

---

✨ Logging Options ✨

• -d string, -log-level string — log level. A comma separated list of levels from: ERROR, WARN, INFO, TRANSFER, DUMP, ALL. TRANSFER includes the same statistics that get sent to the separate transfer log when -log-transfer is used. Example: error,warn,info. You may also specify a numeric level of 1-255. The default level is ERROR.

This option can also be set in the configuration file as log_level. The default value of this option is ERROR.

• -log-module string — the globus_logging module that will be loaded. If not set, the default stdio module will be used, and the logfile options apply. Built in modules are stdio and syslog. Log module options may be set by specifying module:opt1=val1:opt2=val2. Available options for the built in modules are interval and buffer, for buffer flush interval and buffer size, respectively. The default options are a 64k buffer size and a 5 second flush interval. A 0 second flush interval will disable periodic flushing, and the buffer will only flush when it is full. A value of 0 for buffer will disable buffering and all messages will be written immediately. Example: -log-module stdio:buffer=4096:interval=10

This option can also be set in the configuration file as log_module.

• -l string, -logfile string — path of a single file to log all activity to. If neither this option or log_unique is set, logs will be written to stderr unless the execution mode is detached or inetd, in which case logging will be disabled.

This option can also be set in the configuration file as log_single.

• -L string, -logdir string — partial path to which gridftp.(pid).log will be appended to construct the log filename. Example: -L /var/log/gridftp/ will create a separate log ( /var/log/gridftp/gridftp.xxxx.log ) for each process (which is normally each new client session). If neither this option or log_single is set, logs will be written to stderr unless the execution mode is detached or inetd, in which case logging will be disabled. 🌸

This option can also be set in the configuration file as log_unique.

• -Z string, -log-transfer string — log netlogger style info for each transfer into this file. You may also use the log-level of TRANSFER to include this info in the standard log.

This option can also be set in the configuration file as log_transfer.

• -log-filemode string — file access permissions of log files. Should be an octal number such as 0644.

This option can also be set in the configuration file as log_filemode.

• -disable-usage-stats — usage statistics collection is no longer supported. This option is ignored. 💀

This option can also be set in the configuration file as disable_usage_stats. The default value of this option is TRUE.

• -usage-stats-target string — usage statistics collection is no longer supported. This option is ignored. 💀

This option can also be set in the configuration file as usage_stats_target.

• -usage-stats-id string — usage statistics collection is no longer supported. This option is ignored. 💀

This option can also be set in the configuration file as usage_stats_id.

---

🌈 Single and Striped Remote Data Node Options 🌈

• -r string, -remote-nodes string — comma separated list of remote node contact strings.

This option can also be set in the configuration file as remote_nodes.

• -hybrid — when a server is configured for striped operation with the remote_nodes option, both a frontend and backend process are started even if the client does not request multiple stripes. This option will start backend processes only when striped operation is requested by the client, while servicing non-striped requests with a single frontend process. 🦋

This option can also be set in the configuration file as hybrid. The default value of this option is FALSE.

• -dn, -data-node — this server is a backend data node.

This option can also be set in the configuration file as data_node. The default value of this option is FALSE.

• -sbs number, -stripe-blocksize number — size in bytes of sequential data that each stripe will transfer.

This option can also be set in the configuration file as stripe_blocksize. The default value of this option is 1048576.

• -stripe-count number — number of stripes to use per transfer when this server controls that number. If remote nodes are statically configured (via -r or remote_nodes), this will be set to that number of nodes, otherwise the default is 1.

This option can also be set in the configuration file as stripe_count.

• -sl number, -stripe-layout number — stripe layout.
  • 1 = Partitioned
  • 2 = Blocked

This option can also be set in the configuration file as stripe_layout. The default value of this option is 2.

• -stripe-blocksize-locked — do not allow client to override stripe blocksize with the OPTS RETR command. 🔒

This option can also be set in the configuration file as stripe_blocksize_locked. The default value of this option is FALSE.

• -stripe-layout-locked — do not allow client to override stripe layout with the OPTS RETR command. 🔒

This option can also be set in the configuration file as stripe_layout_locked. The default value of this option is FALSE.

---

💾 Disk Options 💾

• -bs number, -blocksize number — size in bytes of data blocks to read from disk before posting to the network.

This option can also be set in the configuration file as blocksize. The default value of this option is 262144.

• -sync-writes — flush disk writes before sending a restart marker. Basically it's trying to make sure the range in the restart marker has actually been committed to disk. Heads up though: this will probably tank your performance, and different storage systems might do different things with it. See the manpage for sync() for more.

You can also set this in the config file as sync_writes. Default? FALSE. 💅

• -perms string — set the default permissions for created files. Should be an octal number like 0644. The default is 0644. ⚠️ Note: if umask is set it'll affect this setting — like, if the umask is 0002 and this setting is 0666, the resulting files get created with permissions of 0664.

You can also set this in the config file as perms.

• -file-timeout number — timeout in seconds for all disk accesses. A value of 0 disables the timeout entirely.

You can also set this in the config file as file_timeout.

✨ Network Options ✨

• -p number, -port number — the port a frontend listens on for client control channel connections, or the port a data node listens on for connections from a frontend. If you don't set it, a random port gets chosen and printed out via the logging mechanism. 🎀

You can also set this in the config file as port.

• -control-interface string — hostname or IP address of the interface to listen for control connections on. Not set? It listens on all interfaces.

You can also set this in the config file as control_interface.

• -data-interface string — hostname or IP address of the interface to use for data connections. Not set? It uses the current control interface.

You can also set this in the config file as data_interface.

• -ipc-interface string — hostname or IP address of the interface to use for ipc connections. Not set? It listens on all interfaces.

You can also set this in the config file as ipc_interface.

• -hostname string — effectively sets the control_interface, data_interface and ipc_interface options above, all in one go. Efficiency queen 👑

You can also set this in the config file as hostname.

• -ipc-port number — port on which the frontend will listen for data node connections.

You can also set this in the config file as ipc_port.

• -control-preauth-timeout number — time in seconds to let a client stay connected to the control channel with zero activity before it has to authenticate.

You can also set this in the config file as control_preauth_timeout. Default is 120.

• -control-idle-timeout number — time in seconds to let a client stay connected to the control channel without any activity.

You can also set this in the config file as control_idle_timeout. Default is 600.

• -ipc-idle-timeout number — idle time in seconds before an unused ipc connection gets closed. bye bestie 👋

You can also set this in the config file as ipc_idle_timeout. Default is 900.

• -ipc-connect-timeout number — time in seconds before an attempted ipc connection gets cancelled.

You can also set this in the config file as ipc_connect_timeout. Default is 60.

• -allow-udt — enables protocol support for UDT with NAT traversal, if the udt driver is available. Requires threads.

You can also set this in the config file as allow_udt. Default is FALSE.

• -port-range string — port range to use for incoming connections. Format is "startport,endport". This, together with -data-interface, can be used to enable operation behind a firewall and/or when NAT is involved. This is the same as setting the environment variable GLOBUS_TCP_PORT_RANGE.

You can also set this in the config file as port_range.

• -epsv-ip — adds an IPv6 address to the EPSV response. Yes it breaks RFC 2428, but it lets redirection work with IPv6. 💀

You can also set this in the config file as epsv_ip. Default is FALSE.

• -epsv-match — makes EPSV behaviour more compliant with RFC 2428 by choosing the default data connection protocol based on the control connection protocol.

You can also set this in the config file as epsv_match. Default is FALSE.

💌 User Messages 💌

• -banner string — message to show the client before authentication.

You can also set this in the config file as banner.

• -banner-file string — file to read the banner message from.

You can also set this in the config file as banner_file.

• -banner-terse — when this is set, the minimum allowed banner message gets displayed to unauthenticated clients. lowkey mysterious ✨

You can also set this in the config file as banner_terse. Default is FALSE.

• -banner-append — when this is set, the message set in the banner or banner_file option gets appended to the default banner message instead of replacing it.

You can also set this in the config file as banner_append. Default is FALSE.

• -version-tag string — add an identifying string to the existing toolkit version. It shows up in the default banner message, the SITE VERSION command, and usage stats.

You can also set this in the config file as version_tag.

• -login-msg string — message to show the client after authentication.

You can also set this in the config file as login_msg.

• -login-msg-file string — file to read the login message from.

You can also set this in the config file as login_msg_file.

🧩 Module Options 🧩

• -dsi string — Data Storage Interface module to load. File and remote modules are defined by the server. If it's not set, the file module gets loaded — unless the remote option is specified, in which case the remote module gets loaded. An additional configuration string can be passed to the DSI using the format [module name]:[configuration string] for this option. The format of that configuration string is defined by the DSI being loaded.

You can also set this in the config file as load_dsi_module.

• -allowed-modules string — comma separated list of ERET/ESTO modules to allow, and optionally an alias for each. Example: module1,alias2:module2,module3 (module2 will be loaded when a client asks for alias2).

You can also set this in the config file as allowed_modules.

• -dc-whitelist string — a comma separated list of drivers allowed on the network stack.

You can also set this in the config file as dc_whitelist.

• -fs-whitelist string — a comma separated list of drivers allowed on the disk stack.

You can also set this in the config file as fs_whitelist.

• -popen-whitelist string — a comma separated list of programs the popen driver is allowed to execute, when used on the network or disk stack. An alias may also be specified so a client doesn't need to type the full path. Format is [alias:]prog,[alias:]prog. Example: /bin/gzip,tar:/bin/tar

You can also set this in the config file as popen_whitelist.

• -xnetmgr string — an option string to pass to the XIO Network Manager Driver, which then gets loaded for all data channel connections. Must be in the form "manager=module;option1=value;option2=value;". See the Network Manager documentation for more info.

You can also set this in the config file as xnetmgr.

• -dc-default string — a comma separated list of XIO drivers and options representing the default network stack. Format for each driver entry is driver1[:opt1=val1;opt2=val2;...]. The bottom of the stack, the transport driver, is always first.

You can also set this in the config file as dc_default.

• -fs-default string — a comma separated list of XIO drivers and options representing the default disk stack. Format for each driver entry is driver1[:opt1=val1;opt2=val2;...]. The bottom of the stack, the transport driver, is always first.

You can also set this in the config file as fs_default.

🌈 Other 🌈

• -c string — path to the main configuration file that should be loaded. Otherwise it'll try to load $GLOBUS_LOCATION/etc/gridftp.conf and /etc/grid-security/gridftp.conf.
• -C string — path to a directory holding configuration files that should be loaded. Files get loaded in alphabetical order, and if there are duplicate parameters the last loaded file wins. Backup files and files created by package updates (e.g. file.rpmsave) get ignored. Note that the main configuration file, if one exists, will always be loaded last.

You can also set this in the config file as config_dir.

• -config-base-path string — base path to use when config and log path options aren't full paths. By default this is the current directory at the time the process starts.

You can also set this in the config file as config_base_path.

• -debug — sets options that make the server easier to debug. Forces no-fork, no-chdir, and allows core dumps on bad signals instead of exiting cleanly. 🚨 Not recommended for production servers. Note that non-forked servers running as root will only accept a single connection, and then exit.

You can also set this in the config file as debug. Default is FALSE.

• -pidfile string —

You can also set this in the config file as pidfile.

okay bestie, real talk: the original manpage literally gives this one no description. nothing. empty. I'm not making anything up for you, so it just vibes there in silence 💀

---

🌟 EXIT STATUS 🌟

1. 0 — successful program execution. slay. that's it, that's the whole list. periodt 💅

---

<div style="text-align:center">💖</div>

and that's the whole page, bestie!! this one's from the Grid Community Toolkit 6, dated 08/22/2019, and it lives under the name GLOBUS-GRIDFTP-SER(8). go forth and configure responsibly 🫶✨🌸