ftpd

Synopsis #

OpenBSD includes an FTP client (ftp(1)) and server (ftpd(8)) in the base system. Use FTP when a client or existing workflow requires it. FTP sends credentials and data without encryption; use SFTP through sshd for authenticated file transfer over untrusted networks, or HTTPS for downloads.

Features #

• ftp(1) supports both FTP and HTTP downloads
• Supports active and passive modes
• Handles anonymous and authenticated access
• Chroot for anonymous users and users listed in /etc/ftpchroot
• Suitable for automation and scripting
• Included in the OpenBSD base system

FTP Server Comparison #

The supported choices documented here are:

ProFTPD is not in the official OpenBSD 8.0 ports tree or amd64 package set. Prefer SFTP for encrypted file access unless FTP compatibility is required.

FTP Client #

The base-system ftp(1) client retrieves files over FTP and HTTP. It accepts URLs, follows HTTP redirects, supports proxies, and handles passive and active FTP transfers.

Basic Usage #

To download a file via FTP:

ftp ftp://ftp.openbsd.org/pub/OpenBSD/8.0/README

To download a file via HTTP:

ftp https://cdn.openbsd.org/pub/OpenBSD/8.0/amd64/install80.img

To download and rename:

ftp -o obsd.img https://cdn.openbsd.org/pub/OpenBSD/8.0/amd64/install80.img

To download multiple files with a glob expression:

ftp 'ftp://ftp.example.com/pub/*.txt'

Use quotes to prevent shell globbing.

Interactive Mode #

When invoked without a URL, ftp(1) enters interactive mode:

$ ftp
ftp> open ftp.openbsd.org
ftp> user anonymous
ftp> cd pub/OpenBSD/8.0/amd64
ftp> get install80.img
ftp> quit

In this mode, standard FTP commands are accepted, such as cd, get, put, ls, and bye.

Common Flags #

• -p: Enable passive mode (default), with active-mode fallback if unsupported by the server
• -A: Use active mode
• -o <filename>: Write output to a specific file
• -M: Disable the progress meter
• -r seconds: Retry a failed connection after the specified interval
• -V: Disable verbose output

Active vs Passive Mode #

FTP supports two modes for establishing data connections: active and passive. The choice impacts firewall and NAT compatibility.

Active Mode #

In active mode, the client tells the server which IP address and port to connect back to. This is often blocked by client-side firewalls or NAT devices.

Flow:

1. Client connects to server on TCP port 21 (control connection).
2. Client issues PORT command, telling server its own IP and port.
3. Server opens a new connection back to the client (data connection).

ftp -A ftp://ftp.example.com

Passive Mode #

In passive mode, the server tells the client which port to connect to. The client initiates both control and data connections. This is the default in OpenBSD.

Flow:

1. Client connects to server on port 21.
2. Client issues PASV command.
3. Server replies with IP and port.
4. Client connects to the server’s port (data connection).

ftp -p ftp://ftp.example.com

Passive mode is generally recommended unless a specific server requires active mode.

Proxy Support #

To use ftp(1) behind a proxy:

Set the ftp_proxy or http_proxy environment variable:

export ftp_proxy=http://proxy.example.com:8080
ftp ftp://ftp.example.com

Scripting Downloads #

Example download script:

#!/bin/sh
URL="https://cdn.openbsd.org/pub/OpenBSD/8.0/amd64/install80.img"
OUT="install80.img"

ftp -o "$OUT" "$URL"

HTTP Authentication #

For password-protected HTTP URLs:

ftp https://user:pass@example.com/private/file.tar.gz

Credentials are visible in the process list. Use with care.

FTP Server #

The base-system ftpd(8) serves files to anonymous users and local accounts. Restrict it to trusted networks because it does not encrypt credentials or file data.

Enabling the Server #

To enable and start the FTP daemon:

doas rcctl enable ftpd
doas rcctl start ftpd

Configuration Options #

The default behavior requires no configuration file. Behavior is controlled by flags passed via rcctl(8).

View current settings:

doas rcctl get ftpd flags

Restrict logins to anonymous users and accounts selected for chroot:

doas rcctl set ftpd flags -A

Start the daemon:

doas rcctl restart ftpd

Common Flags #

• -A: Permit only anonymous or chroot-restricted accounts
• -D: Run as a standalone daemon (already supplied by the rc script)
• -S: Log anonymous downloads to /var/log/ftpd, which must already exist
• -l: Log sessions; repeat as -ll to log file operations

Anonymous FTP #

To enable anonymous access:

1. Create the ftp account if it does not already exist, with /home/ftp as its home and no usable password. Then prepare a root-owned, non-writable anonymous root:

   doas useradd -d /home/ftp -s /sbin/nologin ftp
   doas mkdir -p /home/ftp/pub
   doas chown root:wheel /home/ftp
   doas chmod 755 /home/ftp
   

2. Place files under /home/ftp/pub.

3. Start ftpd with the -A flag:

   doas rcctl set ftpd flags -A
   doas rcctl restart ftpd
   

Users may now connect with:

ftp ftp://hostname/pub/

Anonymous users are chrooted to /home/ftp.

Authenticated FTP #

FTP uses system accounts that are not blocked by /etc/ftpusers. Accounts outside a chroot need a valid login shell. For accounts chrooted through /etc/ftpchroot or their login class, ftpd skips this shell check. Setting /sbin/nologin alone is not a complete FTP-only policy. Check which services each account can use, and prefer SFTP-only access when shell access must be disabled. Add users to /etc/ftpchroot to enable chroot for them.

Logging #

Enable session and file-operation logging through syslog with -ll; inspect the destination configured for the FTP facility in /etc/syslog.conf:

doas rcctl set ftpd flags "-A -ll"
doas rcctl restart ftpd

Alternatives to FTP #

Use FTP only when required for legacy or compatibility purposes. Otherwise, prefer encrypted protocols such as sftp.

Summary of Key Commands #

Security Considerations #

FTP is an insecure protocol by design, transmitting credentials and data in plaintext. For external use or untrusted networks, use sftp or another encrypted transport.

FTP may be acceptable for:

• Internal or air-gapped networks
• Public file distribution (anonymous-only)
• Specific automation tasks with legacy systems