github.com/troglobit / uftpd

FTP/TFTP server that just works™

Commit log
54e08e7 ⎇ master🏷 v2.17Bump version for v2.17 release Joachim Wiberg 41 hours ago
643beaa .github: build the release tarball and .deb in parallel Joachim Wiberg 47 hours ago
278aebb Update changelogs Joachim Wiberg 47 hours ago
666b1a4 test: cover malformed TFTP requests Joachim Wiberg 47 hours ago
e6cdd98 tftp: reply with RFC 1350 error strings Joachim Wiberg 47 hours ago
642d488 tftp: fix ERROR reply construction Joachim Wiberg 47 hours ago
212aaf9 tftp: ignore DATA with no transfer open Joachim Wiberg 47 hours ago
a1c1db8 tftp: clamp negotiated blksize to the RFC 2348 maximum Joachim Wiberg 47 hours ago
4fd4d22 tftp: bound RRQ/WRQ option parsing Joachim Wiberg 47 hours ago
52e78b3 tftp: check packet length before dispatch Joachim Wiberg 47 hours ago
README.md
☰
README.mdISC licensecontributingcode of conductsecurity
source raw blame

No Nonsense FTP/TFTP Server

License Badge Release Badge GitHub Status Coverity Status

uftpd is a UNIX daemon with sane built-in defaults. It just works.

Features

  • FTP and/or TFTP
  • No complex configuration file
  • Runs from standard UNIX inetd, or standalone
  • Uses ftp user's $HOME, from /etc/passwd, or custom path
  • Uses ftp/tcp and tftp/udp from /etc/services, or custom ports
  • Privilege separation, drops root privileges having bound to ports
  • Possible to use symlinks outside of the FTP home directory
  • Possible to have group writable FTP home directory

Usage

uftpd [-hnsv] [-l LEVEL] [-o OPTS] [PATH]

  -h         Show this help text
  -l LEVEL   Set log level: none, err, notice (default), info, debug
  -n         Run in foreground, do not detach from controlling terminal
  -o OPT     Options:
                      ftp=PORT
                      tftp=PORT
                      pasv_addr=ADDR
                      writable
  -s         Use syslog, even if running in foreground, default w/o -n
  -v         Show program version

The optional 'PATH' defaults to the $HOME of the /etc/passwd user 'ftp'
Bug report address: https://github.com/troglobit/uftpd/issues

To start uftpd in the background as an FTP/TFTP server:

$ uftpd

If the ftp user does not exist on your system, uftpd defaults to serve files from the /srv/ftp directory. To serve another directory, simply append that directory to the argument list.

Use sudo, or set CAP_NET_BIND_SERVICE capabilities, on uftpd to allow regular users to start uftpd on privileged (standard) ports, i.e. < 1024:

$ sudo setcap cap_net_bind_service+ep uftpd

To change port on either FTP or TFTP, use:

$ uftpd -o ftp=PORT,tftp=PORT

Set PORT to zero (0) to disable either service.

New sessions are dropped by default if uftpd detects the FTP root is writable. To allow writable FTP root:

$ uftpd -o writable PATH

Since v2.11 uftpd logs a lot more events by default. Set up your syslogd to redirect LOG_FTP to a separate log file, or reduce the log level of uftpd using -l error to only log errors and higher.

Running from inetd

Rarely used services like FTP/TFTP are good candidates to run from the Internet super server, inetd. On Debian and Ubuntu based distributions we recommend openbsd-inetd.

Use the following two lines in /etc/inetd.conf, notice how in.ftpd and in.tftpd are symlinks to the uftpd binary:

ftp     stream  tcp nowait  root    /usr/sbin/in.ftpd
tftp    dgram   udp wait    root    /usr/sbin/in.tftpd

Remember to activate your changes to inetd by reloading the service or sending SIGHUP to it. Another inetd server may use different syntax. Like the inetd that comes built-in to Finit, in /etc/finit.conf:

inetd ftp/tcp   nowait /usr/sbin/in.ftpd  -- The uftpd FTP server
inetd tftp/udp    wait /usr/sbin/in.tftpd -- The uftpd TFTP server

Caveat

uftpd is primarily not targeted at secure installations, it is targeted at users in need of a simple FTP/TFTP server.

uftpd allows symlinks outside the FTP root, as well as a group writable FTP home directory — user-friendly features that potentially can cause security breaches, but also very useful for people who just want their FTP server to work. A lot of care has been taken, however, to lock down and secure uftpd by default.

Build & Install

Debian/Ubuntu

$ curl -sS https://deb.troglobit.com/pubkey.gpg | sudo apt-key add -
$ echo "deb [arch=amd64] https://deb.troglobit.com/debian stable main" | sudo tee /etc/apt/sources.list.d/troglobit.list
$ sudo apt-get update && sudo apt-get install uftpd

Building from Source

uftpd depends on two other projects to build from source, libuEv and lite. See their respective README for details, there should be no real surprises, both use the familiar configure, make, make install.

To find the two libraries uftpd depends on pkg-config. The package name for your Linux distribution varies, on Debian/Ubuntu systems:

$ sudo apt install pkg-config
...

uftpd, as well as its dependencies, can be built as .deb packages on Debian or Ubuntu based distributions. Install the packaging tools, and the -dev packages of the dependencies, then run

$ sudo apt install devscripts debhelper lintian po-debconf
$ ./autogen.sh      # Only needed if using GIT sources
$ ./configure
...
$ make package
...

Note, dpkg-shlibdeps looks the dependencies up in the installed .deb packages, so libuev-dev and libite-dev must come from apt -- a libuEv or libite installed from source under /usr/local is not enough.

The .deb package takes care of setting up /etc/inetd.conf, create an ftp user and an /srv/ftp home directory with write permissions for all members of the users group.

If you are using a different Linux or UNIX distribution, check the output from ./configure --help, followed by make all install. For instance, building on Alpine Linux:

$ PKG_CONFIG_LIBDIR=/usr/local/lib/pkgconfig ./configure \
        --prefix=/usr --localstatedir=/var --sysconfdir=/etc

Provided the library dependencies were installed in /usr/local/. This PKG_CONFIG_LIBDIR trick may be needed on other GNU/Linux, or UNIX, distributions as well.

Origin & References

uftpd was originally based on FtpServer by Xu Wang, but is now a complete rewrite with TFTP support by Joachim Wiberg, maintained at GitHub.