ftpd deprecated in 15; docs lag

Tftpd is requiered for enabling , amongs others, CISCO switch/router IOS images upload .

Today I use scp /sftp and FIlezilla to port 22 , to transfer files.
 
So you're suggesting to give SSH-access to the guys and gals that currently have FTP-access only? How does that enhance security?
JUST.PUT.IT.BACK.
Pretty please.
 
Ome Ko said:
So you're suggesting is give SSH-access to the guys and gals that currently have FTP-access only? How does that enhance security?
JUST.PUT.IT.BACK.
Pretty please.
Click to expand...
You can tune sshd to limit security problems, knowing that it's already secure at the base. You might even forbid ssh session to only have sftp server.

FTP is not the more secure protocol, to say it softly.
 
Emrion said:
You can tune sshd to limit security problems, knowing that it's already secure at the base. You might even forbid ssh session to only have sftp server.

FTP is not the more secure protocol, to say it softly.
Click to expand...
I know. But it has inetd and it has ftpchroot. I need all of ssh to maintain my server.
Please explain how I can limit the current ftpuser to only use sftp and not run any commands in the directory this wil give him access to.
 
putney said:
The package description for ftp/freebsd-ftpd says:
Click to expand...
Yes. I noticed. The thing is we're not encouraged to mix ports and pkgs and installing from ports requires /usr/src, so it turns out you need a lot of extra files to install it. It's all not as straightforward as it (freebsd) used to be.
Come on, just put it back! It saves someone from updating the docs as well. 👍
 
putney said:
The package description for ftp/freebsd-ftpd says:
Click to expand...
I believe this is what's happened to other things that used to be part of base that got deprecated.
pkg search ftpd shows a bunch of options.

Ome Ko said:
The thing is we're not encouraged to mix ports and pkgs and installing from ports requires /usr/src, so it turns out you need a lot of extra files to install it.
Click to expand...
pkg search on a 15.1 system is telling me it finds "freebsd-ftpd-20260512"
That implies to me there is a package being built; are you not installing packages and building ports instead?
 
Nice. I can sense a consensus being reached here over de-deprecating ftpd and cleaning up this mess in the process.
Now who should we call? ☎️
 
Ome Ko said:
So you're suggesting to give SSH-access to the guys and gals that currently have FTP-access only? How does that enhance security?
Click to expand...

Ome Ko said:
Please explain how I can limit the current ftpuser to only use sftp and not run any commands in the directory this wil give him access to.
Click to expand...

I am far from being an expert but sftp used via a chroot environment seems fine to me.
Once users logged in with the right permissions (read-only if you want) it's safe, nothing but sftp commands which look like a lot to ftp ones.
There is a bit of configuration to make that happen but nothing difficult.

Look at this blog post written by Micski , straight forward and well explained. It's a good blog BTW there is some good FreeBSD stuff to read, thanks to him.
www.micski.dk

SFTP server with OpenSSH on FreeBSD.

Setup an SFTP server with OpenSSH on FreeBSD. SFTP can be used for sharing and exchanging files with clients and users.
www.micski.dk www.micski.dk

Also if you are still interested by ftp readings then sidetone wrote good threads, hopefully you might find something that helps you.
S

Thread 'NetBSD's tnftpd compared to other FTP servers'

ftp/tnftpd is for Traditional/Trivial the NetBSD FTP Daemon, which is the server. ftp/tnftp is the client. They were formerly lukemftpd & lukemftp. These have SSL/TLS security features. The tnftp client has security features for use with https protocol, however, I'm now unsure if tnftp has other SSL/TLS features. tnftpd may not have tls/ssl features, as I had first thought.

TNFTPD files
notable pkg info -l tnftpd files and relevant manpages
Code: 
/usr/local/libexec/tnftpd
/usr/local/share/examples/tnftpd/ftpd.conf...
  • Like
S

Thread 'Howto: Anonymous FTP server on LAN: FreeBSD's FTPD'

Using FreeBSD's /usr/libexec/ftpd which will soon be ftp/freebsd-ftpd. This doesn't use a secure connection, so it's not meant for transferring confidential files. The way the anonymous ftpd server is set up, it doesn't use a password either. Read only mode is optional.

Add FTP user
adduser
Code: 
user: ftp
shell: nologin
choose default or custom
 ftp home directory
To later change directory or other variables, use chsh(1). On FreeBSD, ftpd will select this as the home directory.

FTPD directories and permissions
~/ftp/ set permissions to...
  • Like
S

IPFW Thread 'ftpd internet access control: IPFW and hosts.allow'

With FTPD in FreeBSD's base, while relevant to all ftpd servers. I've gotten the IPFW firewall to work with clients which use IPv4. However, my firewall blocks Ethernet clients (in this case an Android with an FTP client ap) which seem to rely only on IPv6, unless, I write the IPv6 address into the Firewall setting.

rc.conf
Code: 
firewall_enable="YES"
firewall_type="workstation"
firewall_myservices="21/tcp 35000-65000/tcp"
firewall_allowservices="host-ftpd-on-freebsd.domain.ltld alias-android.lan-domain.ltld android-ipv6-address"
In allow services, one is my own computer, and...

Good luck and have fun.
 
gotnull said:
Good luck and have fun.
Click to expand...
This is really helpful. Thanks for your contribution! I'm gonna test all this after asking the sysadmins of the company that is using the FTP-account on my server if they are able to upgrade to sftp and accepting my self-made-cert (the regular hourly ftp-batches are already complicated for them).
It's all windows 365 overthere, zo they're prolly going to say yes, but we all know it's gonna take at least 2 months.

(in the mean time I still prefer for ftpd to return)
 
Ome Ko said:
(in the mean time I still prefer for ftpd to return)
Click to expand...

Literally NO ONE is stopping you from installing ftpd?

Here is a link to it: https://www.freshports.org/ftp/freebsd-ftpd/
Download, compile, install and you are all good - go on with your life.

And "NO", by default, we are not going install a file transfer product that can run (unencrypted) over the unprotected INTERNET and compromise peoples files "in transit" to and from a destination host. Really? You think we are all going to do that "anyway" in order to support YOUR one business case verses the health of the entire FreeBSD infrastructure?

If you REALLY need backwards compatibility then use an older FreeBSD release. Version 13 probably does what you want with ftpd?

Don't you think I am not mad that FreeBSD removed uucico(8) from the base system? How am I going to support my uucp(8) and USENET traffic now? I might even have to switch to Linux !
 
It's still available as ftp/freebsd-ftpd. This is mentioned in the posts that gotnull and CShell posted above. It moved from the base system to that.

Sftp isn't ftp, but it's similar in name and basic purpose, but it functions alongside SSH rules, rather than that of ftp. I couldn't figure out how to limit which directories where available for sftp. If you want to learn sftp and ssh, that's an alternative route.
 
You must log in or register to reply here.
Back
Top