fedora-docs-l10n/fedora-system-administrat/f30/pages/_partials/servers/FTP

Zen

	English	French	Actions
	FTP
	indexterm:[FTP,definition of]indexterm:[FTP,vsftpd] _File Transfer Protocol_ (`FTP`) is one of the oldest and most commonly used protocols found on the Internet today. Its purpose is to reliably transfer files between computer hosts on a network without requiring the user to log directly into the remote host or have knowledge of how to use the remote system. It allows users to access files on remote systems using a standard set of simple commands.
	This section outlines the basics of the `FTP` protocol, as well as configuration options for the primary `FTP` server shipped with {MAJOROS}, [command]#vsftpd#.
	The File Transfer Protocol
	indexterm:[FTP,introducing] However, because `FTP` is so prevalent on the Internet, it is often required to share files to the public. System administrators, therefore, should be aware of the `FTP` protocol's unique characteristics.
	Multiple Ports, Multiple Modes
	indexterm:[FTP,command port]indexterm:[FTP,data port]indexterm:[FTP,active mode]indexterm:[FTP,passive mode] Unlike most protocols used on the Internet, `FTP` requires multiple network ports to work properly. When an `FTP` client application initiates a connection to an `FTP` server, it opens port 21 on the server — known as the _command port_. This port is used to issue all commands to the server. Any data requested from the server is returned to the client via a _data port_. The port number for data connections, and the way in which data connections are initialized, vary depending upon whether the client requests the data in _active_ or _passive_ mode.
	The following defines these modes:
	active mode
	Active mode is the original method used by the `FTP` protocol for transferring data to the client application. When an active mode data transfer is initiated by the `FTP` client, the server opens a connection from port 20 on the server to the `IP` address and a random, unprivileged port (greater than 1024) specified by the client. This arrangement means that the client machine must be allowed to accept connections over any port above 1024. With the growth of insecure networks, such as the Internet, the use of firewalls to protect client machines is now prevalent. Because these client-side firewalls often deny incoming connections from active mode `FTP` servers, passive mode was devised.
	passive mode
	Passive mode, like active mode, is initiated by the `FTP` client application. When requesting data from the server, the `FTP` client indicates it wants to access the data in passive mode and the server provides the `IP` address and a random, unprivileged port (greater than 1024) on the server. The client then connects to that port on the server to download the requested information.
	While passive mode resolves issues for client-side firewall interference with data connections, it can complicate administration of the server-side firewall. You can reduce the number of open ports on a server by limiting the range of unprivileged ports on the `FTP` server. This also simplifies the process of configuring firewall rules for the server. See xref:File_and_Print_Servers.adoc#s3-ftp-vsftpd-conf-opt-net[Network Options] for more information about limiting passive ports.
	FTP Servers
	indexterm:[FTP,server software,vsftpd]indexterm:[FTP,server software,Red Hat Content Accelerator]indexterm:[vsftpd,FTP]indexterm:[vsftpd,security features] {MAJOROS} ships with two different `FTP` servers:
	[command]#proftpd# - A fast, stable, and highly configurable FTP server.
	[command]#vsftpd# — A fast, secure `FTP` daemon which is the preferred `FTP` server for {MAJOROS}. The remainder of this section focuses on [command]#vsftpd#.
	[command]#vsftpd#
	_The Very Secure FTP Daemon_ ([command]#vsftpd#) is designed from the ground up to be fast, stable, and, most importantly, secure. [command]#vsftpd# is the only stand-alone `FTP` server distributed with {MAJOROS}, due to its ability to handle large numbers of connections efficiently and securely.
	The security model used by [command]#vsftpd# has three primary aspects:
	Strong separation of privileged and non-privileged processes — Separate processes handle different tasks, and each of these processes run with the minimal privileges required for the task.
	Tasks requiring elevated privileges are handled by processes with the minimal privilege necessary — By leveraging compatibilities found in the `libcap` library, tasks that usually require full `root` privileges can be executed more safely from a less privileged process.
	Most processes run in a [command]#chroot# jail — Whenever possible, processes are change-rooted to the directory being shared; this directory is then considered a [command]#chroot# jail. For example, if the directory [command]#/var/ftp/# is the primary shared directory, [command]#vsftpd# reassigns [command]#/var/ftp/# to the new root directory, known as [command]#/#. This disallows any potential malicious hacker activities for any directories not contained below the new root directory.
	Use of these security practices has the following effect on how [command]#vsftpd# deals with requests:
	The parent process runs with the least privileges required — The parent process dynamically calculates the level of privileges it requires to minimize the level of risk. Child processes handle direct interaction with the `FTP` clients and run with as close to no privileges as possible.
	All operations requiring elevated privileges are handled by a small parent process — Much like the Apache `HTTP` Server, [command]#vsftpd# launches unprivileged child processes to handle incoming connections. This allows the privileged, parent process to be as small as possible and handle relatively few tasks.
	All requests from unprivileged child processes are distrusted by the parent process — Communication with child processes are received over a socket, and the validity of any information from child processes is checked before being acted on.
	Most interaction with `FTP` clients is handled by unprivileged child processes in a [command]#chroot# jail — Because these child processes are unprivileged and only have access to the directory being shared, any crashed processes only allows the attacker access to the shared files.
	Files Installed with [command]#vsftpd#

Loading…

None String updated in the repository fedora-docs-l10n/fedora-system-administrat f30/pages/_partials/servers/FTP French	English FTP Servers French 12 characters edited Current translation Empty ~~Serveurs FTP~~ 4 months ago
julroy67 Translation changed fedora-docs-l10n/fedora-system-administrat f30/pages/_partials/servers/FTP French	English FTP Servers French 1 character edited Serveurs FTP 4 years ago
julroy67 Suggestion accepted fedora-docs-l10n/fedora-system-administrat f30/pages/_partials/servers/FTP French	English FTP Servers French 11 characters edited Serveur FTP 4 years ago
None Suggestion added fedora-docs-l10n/fedora-system-administrat f30/pages/_partials/servers/FTP French	English FTP Servers French 11 characters edited Serveur FTP 4 years ago