Pure FTP server
.:. PURE-FTPD .:. Documentation for version 1.0.54
------------------------ BLURB ------------------------Pure-FTPd is a fast, production-quality, standard-conformant FTP server, based upon Troll-FTPd.
The server has been designed to be secure in default configuration, it has no known vulnerability, it is really trivial to set up and it is especially designed for modern kernels. It was successfully ported to Linux, FreeBSD, Dragonfly BSD, NetBSD, OpenBSD, OSX, AIX and more.
Features include chroot()ed and/or virtual chroot()ed home directories, virtual domains, built-in 'ls', anti-warez system, configurable ports for passive downloads, FXP protocol, bandwidth throttling, ratios, LDAP / MySQL / PostgreSQL-based authentication, fortune files, Apache-like log files, fast standalone mode, text / HTML / XML real-time status report, virtual users, virtual quotas, privilege separation, TLS and more.
------------------------ WHO'S USING IT? ------------------------Many people new to Unix are running Pure-FTPd because they find it easy to install. But that software is also used on embedded systems and highly loaded production servers, especially for hosting services.
For large sites with centralized user management, Pure-FTPd provides flexible authentication schemes including SQL and LDAP backends, plus the ability to easily write new custom handlers in any language.
------------------------ COMPILATION ------------------------In its current form, Pure-FTPd uses some OS-specific system calls. And although some portability work has been done in order to ease its port to other operating systems, only Linux, FreeBSD, NetBSD, OpenBSD, ISOS, MirBSD, BSDi, DragonflyBSD, Darwin, Solaris, Tru64, Irix, AIX and HPUX are known to work, other operating systems may need some tweaks. With Linux, any modern distribution should be ok.
Create a specific, unprivileged user and group called _pure-ftpd, without any valid shell. Don't use this for anything else, including FTP virtual users.
groupadd _pure-ftpd useradd -g _pure-ftpd -d /var/empty -s /etc _pure-ftpd
If having a user whose name begins with an underscore is a no-go for you, you can also call it pure-ftpd, without the underscore.
If you have Cdialog or Xdialog installed on your system, try the following command to build and install Pure-FTPd:
make -f Makefile.gui
If you don't have Cdialog or if you prefer the conventional way, here it is:
./configure make install-strip
Et voilà! The software is now installed in /usr/local/sbin/pure-ftpd
To launch the server, just type the following command:
/usr/local/sbin/pure-ftpd &
If you installed a binary package (RPM, SLP, Debian), maybe use the following command instead:
/usr/sbin/pure-ftpd &
Your server is ready. Just type 'ftp localhost' to test it. If you want to automatically run the server when the system boots, add the previous command to /etc/rc.d/rc.local or /etc/rc.d/boot.local . Don't forget the '&' sign.
Note:
To uninstall Pure-FTPd (no, do you really want to do this?), use: ./configure make uninstall
------------------------ ADVANCED COMPILATION ------------------------
The "./configure" script accepts some arguments you might want to add before the compilation:
/-------------------- "--with-" switches --------------------/
--with-altlog: in addition to the syslog output, support logging into a specific file, in an alternative format. Currently, the CLF, Stats, W3C and xferlog formats are implemented. CLF (common log format) is the basic format produced by Apache, WebFS, Roxen and most web servers. These log files only record file transfers and they can feed web statistic software (Analog, Webalizer, etc.) to analyze the load of your FTP server. The Stats format is a special output format designed for log file analysis software. The W3C format is a standard format parsed by most commercial log analyzers (all analyzers with support for IIS should deal with it) . Xferlog is the traditional format created by wu-ftpd. Check the -O option later in this documentation for additional info.
--with-brokenrealpath: some Solaris versions have a broken realpath() implementation. If altlog and/or pure-uploadscript doesn't seem to work properly on your system, try to recompile with this switch.
--with-tls: enable TLS support. Read README.TLS for more about this feature.
--with-certfile=: the file with the TLS certificate (see README.TLS). The default is /etc/ssl/private/pure-ftpd.pem .
--with-cookie: display a fortune or a customized banner when a user logs in (see the '-F' option) .
--with-diraliases: support directory aliases ("shortcuts" for the "cd" command) . Please read the appropriate section about this (further in this manual) .
--with-everything: build a big server with almost all features turned on: altlog, cookies, throttling, ratios, ftpwho, upload script, virtual users (puredb), quotas, virtual hosts, directory aliases, external authentication, Bonjour and privilege separation.
--with-extauth: compiles support for external authentication modules. Please read README.Authentication-Modules and the pure-authd(8) man page before enabling this feature. Most users don't need it.
--with-ftpwho: support for the 'pure-ftpwho' command. Enabling this feature needs some extra memory. Better use it when the server is run in standalone mode. It can be way slower in inetd mode.
--with-language=english --with-language=albanian --with-language=german --with-language=romanian --with-language=french --with-language=polish --with-language=spanish --with-language=danish --with-language=italian --with-language=brazilian-portuguese --with-language=slovak --with-language=dutch --with-language=korean --with-language=swedish --with-language=norwegian --with-language=russian --with-language=traditional-chinese --with-language=simplified-chinese --with-language=hungarian --with-language=catalan --with-language=czech: change the language of server messages. Default is english. If you want to contribute a translation, please translate the 'src/messages_en.h' file and send it to .
--with-ldap: use the native LDAP directory support. When this option is enabled, system accounts can be bypassed. You need OpenLDAP to use that feature. If OpenLDAP is installed in a custom location, you can use the --with-ldap= syntax. See the README.LDAP file for more info about LDAP and Pure-FTPd.
--with-minimal: to efficiently use features of modern FTP clients, Pure-FTPd implements the basics of the FTP protocol, with many extensions (SITE IDLE, SITE CHMOD, MLSD, ...) . Using the --with-minimal directive, these extensions won't be compiled in. Also, there will be no standalone server, no lookup for user/group names, no humor and no ASCII support. But the executable file size will be smaller than in a default installation. You need at least GCC 3.3 to compile with this option. Regular expressions are compiled in. If you still want to reduce the size, use --without-globbing in conjunction with --with-minimal. If you are building an embedded system, use this. In all other cases, to avoid complaints from customers (especially with Windows clients), forget this.
--with-mysql: use the native MySQL support for users database. When this option is enabled, system accounts can be bypassed. MySQL client libraries should be installed to use that feature. If MySQL is installed in a custom location, you can use the --with-mysql= syntax. See the README.MySQL file for more info about MySQL and Pure-FTPd.
--with-nonroot: set up a server that doesn't need root privileges to be started. Any regular user can run the server. It can be useful if you have a limited shell access to a non-dedicated hosting server. But some features will be disabled and passwords can only be checked via LDAP, SQL or PureDB. When virtual chroot is enabled, people will be restricted to the directory the server was started in. This is an insecure mode, designed for setting up very temporary servers by regular (non-root) users. Port 2121 will be listened by default in standalone mode. If you want to use the nonroot mode, you must compile and install the software (./configure --prefix=... && make install-strip) . /sbin, /bin and /man directories will be created in that prefix. But you must also add an /etc directory (readable and writeable by the user pure-ftpd will run as) . You can change the anonymous FTP root directory through an environment variable named FTP_ANON_DIR.
--with-pam: use pluggable authentication modules. Don't use this option if your login/passwd pairs are always refused (but the real fix would be to fix your PAM configuration). You need to create a /etc/pam.d/pure-ftpd file to properly use the PAM authentication. The 'pam' directory contains an example of such a file.
--with-paranoidmsg: favor paranoid messages over sysadmin-friendly messages. When this option is enabled, login failures will show the same message to the user, regardless of the source of the problem. Without this option, "Authentication failure" is displayed when this is a password problem and "Sorry, I can't trust you" is displayed when the user has been banned by the sysadmin.
--with-peruserlimits: enable per-user concurrency limits. Avoid this on very loaded servers.
--with-pgsql: use the native Postgres support for users database. When this option is enabled, system accounts can be bypassed. Postgres client libraries should be installed to use that feature. If Postgres is installed in a custom location, you can use the --with-pgsql= syntax. See the README.PGSQL file for more info about Postgres and Pure-FTPd.
--with-puredb: support virtual users, ie. a local users database, independent of your system accounts. Please read the README.Virtual-Users file for more info about virtual users.
--with-quotas: enable virtual quotas. With virtual quotas, you can restrict the maximal number of files a user can store in his account. You can also of course restrict the total size. See the "quotas" section later in this document.
--with-ratios: support upload/download ratios, to please w4r3z fr34k2.
--with-sysquotas: support system quotas (not Pure-FTPd's virtual quotas) .
--with-throttling: support bandwidth throttling (see below).
--with-uploadscript: since 0.98, Pure-FTPd has a nice feature regarding uploads. Any external program or script can be automatically called after a successful upload. It needs another program installed by the Pure-FTPd package, called 'pure-uploadscript'. Check the man page for more info about this.
--with-virtualchroot: usually, when a user is chrooted (-A and -a options), it's impossible to go out of his home directory. Enabling that feature makes it possible: symbolic links are always followed, even if they are pointing to directories not located in the user's home directory. This is very useful for having shared directories (for instance, have a symbolic link to /var/incoming in every home directory) . This feature isn't enabled by default.
--with-virtualhosts: support virtual hosting. It means that you can have different anonymouns FTP areas for each IP address. If your server has only one IP address, you don't need that feature. But if you have multiple IP addresses and if you want a client that connects to IP xxx to get the content of /etc/pure-ftpd/xxx/ instead of ~ftp/ , enable this option. And read the the "VIRTUAL SERVERS" section at the end of this file.
--with-welcomemsg: read 'welcome.msg' files for compatibility with some other FTP servers. This is a security flaw (anonymous users may upload 'welcome.msg' files to add random banners) . Pure-ftpd uses '.banner' files by default.
--with-boring: display boring "professionnal-looking" messages.
--with-bonjour: enable Bonjour support on MacOS X (see the -v switch).
--with-implicittls: build a FTPS server (TLS is implicitly enabl
No open issues yet, or sync has not completed.