ftpd

Synopsis #

OpenBSD includes full support for the File Transfer Protocol (FTP), including both a command-line client (ftp(1)) and a simple, secure FTP server (ftpd(8)). While FTP is largely replaced by secure alternatives such as sftp (via sshd) and httpd for file downloads, it remains useful for compatibility with legacy systems, automation tasks, and minimal environments.

This chapter documents the use of both the FTP client and server on OpenBSD. It also compares FTP to its alternatives, describes active versus passive modes, and provides examples of common operations.

Features #

• ftp(1) supports both FTP and HTTP downloads
• Supports active and passive modes
• Handles anonymous and authenticated access
• Chroot for anonymous users and users listed in /etc/ftpchroot
• Suitable for automation and scripting
• Included in the OpenBSD base system

FTP Server Comparison #

The supported choices documented here are:

ProFTPD is not in the official OpenBSD 8.0 ports tree or amd64 package set. Prefer SFTP for encrypted file access unless FTP compatibility is required.

FTP Client #

The base system includes ftp(1), a secure and script-friendly command-line utility capable of retrieving files over both FTP and HTTP. It supports passive and active transfer modes, URL-based invocation, HTTP redirection, and proxy support.

Basic Usage #

To download a file via FTP:

ftp ftp://ftp.openbsd.org/pub/OpenBSD/8.0/README

To download a file via HTTP:

ftp https://cdn.openbsd.org/pub/OpenBSD/8.0/amd64/install80.img

To download and rename:

ftp -o obsd.img https://cdn.openbsd.org/pub/OpenBSD/8.0/amd64/install80.img

To download multiple files with a glob expression:

ftp 'ftp://ftp.example.com/pub/*.txt'

Use quotes to prevent shell globbing.

Interactive Mode #

When invoked without a URL, ftp(1) enters interactive mode:

$ ftp
ftp> open ftp.openbsd.org
ftp> user anonymous
ftp> cd pub/OpenBSD/8.0/amd64
ftp> get install80.img
ftp> quit

In this mode, standard FTP commands are accepted, such as cd, get, put, ls, and bye.

Common Flags #

• -p: Enable passive mode (default), with active-mode fallback if unsupported by the server
• -A: Use active mode
• -o <filename>: Write output to a specific file
• -M: Disable the progress meter
• -r seconds: Retry a failed connection after the specified interval
• -V: Disable verbose output

Active vs Passive Mode #

FTP supports two modes for establishing data connections: active and passive. The choice impacts firewall and NAT compatibility.

Active Mode #

In active mode, the client tells the server which IP address and port to connect back to. This is often blocked by client-side firewalls or NAT devices.

Flow:

1. Client connects to server on TCP port 21 (control connection).
2. Client issues PORT command, telling server its own IP and port.
3. Server opens a new connection back to the client (data connection).

ftp -A ftp://ftp.example.com

Passive Mode #

In passive mode, the server tells the client which port to connect to. The client initiates both control and data connections. This is the default in OpenBSD.

Flow:

1. Client connects to server on port 21.
2. Client issues PASV command.
3. Server replies with IP and port.
4. Client connects to the server’s port (data connection).

ftp -p ftp://ftp.example.com

Passive mode is generally recommended unless a specific server requires active mode.

Proxy Support #

To use ftp(1) behind a proxy:

Set the ftp_proxy or http_proxy environment variable:

export ftp_proxy=http://proxy.example.com:8080
ftp ftp://ftp.example.com

Scripting Downloads #

Example download script:

#!/bin/sh
URL="https://cdn.openbsd.org/pub/OpenBSD/8.0/amd64/install80.img"
OUT="install80.img"

ftp -o "$OUT" "$URL"

HTTP Authentication #

For password-protected HTTP URLs:

ftp https://user:pass@example.com/private/file.tar.gz

Credentials are visible in the process list. Use with care.

FTP Server #

The base system includes ftpd(8), a secure FTP daemon suitable for basic file serving in trusted networks or chrooted environments. The server supports both anonymous and authenticated sessions.

Enabling the Server #

To enable and start the FTP daemon:

doas rcctl enable ftpd
doas rcctl start ftpd

Configuration Options #

The default behavior requires no configuration file. Behavior is controlled by flags passed via rcctl(8).

View current settings:

doas rcctl get ftpd flags

Restrict logins to anonymous users and accounts selected for chroot:

doas rcctl set ftpd flags -A

Start the daemon:

doas rcctl restart ftpd

Common Flags #

• -A: Permit only anonymous or chroot-restricted accounts
• -D: Run as a standalone daemon (already supplied by the rc script)
• -S: Log anonymous downloads to /var/log/ftpd, which must already exist
• -l: Log sessions; repeat as -ll to log file operations

Anonymous FTP #

To enable anonymous access:

1. Create the ftp account if it does not already exist, with /home/ftp as its home and no usable password. Then prepare a root-owned, non-writable anonymous root:

   doas useradd -d /home/ftp -s /sbin/nologin ftp
   doas mkdir -p /home/ftp/pub
   doas chown root:wheel /home/ftp
   doas chmod 755 /home/ftp
   

2. Place files under /home/ftp/pub.

3. Start ftpd with the -A flag:

   doas rcctl set ftpd flags -A
   doas rcctl restart ftpd
   

Users may now connect with:

ftp ftp://hostname/pub/

Anonymous users are chrooted to /home/ftp.

Authenticated FTP #

FTP uses system accounts that are not blocked by /etc/ftpusers. Accounts outside a chroot need a valid login shell. For accounts chrooted through /etc/ftpchroot or their login class, ftpd skips this shell check. Setting /sbin/nologin alone is not a complete FTP-only policy. Check which services each account can use, and prefer SFTP-only access when shell access must be disabled. Add users to /etc/ftpchroot to enable chroot for them.

Logging #

Enable session and file-operation logging through syslog with -ll; inspect the destination configured for the FTP facility in /etc/syslog.conf:

doas rcctl set ftpd flags "-A -ll"
doas rcctl restart ftpd

Alternatives to FTP #

Use FTP only when required for legacy or compatibility purposes. Otherwise, prefer encrypted protocols such as sftp.

Summary of Key Commands #

Security Considerations #

FTP is an insecure protocol by design, transmitting credentials and data in plaintext. For external use or untrusted networks, use sftp or another encrypted transport.

FTP may be acceptable for:

• Internal or air-gapped networks
• Public file distribution (anonymous-only)
• Specific automation tasks with legacy systems