passive mode
Passive mode, like active mode, is initiated by the FTP client application. When requesting
data from the server, the FTP client indicates it wants to access the data in passive mode
and the server provides the IP address and a random, unprivileged port (greater than 1024)
on the server. The client then connects to that port on the server to download the requested
information.
While passive mode resolves issues for client-side firewall interference with data
connections, it can complicate administration of the server-side firewall. Limiting the range
of unprivileged ports offered for passive connections in the FTP server's configuration file is
one way to reduce the number of open ports on a server and simplify the task of creating
firewall rules for the server. Refer to
Section 5.8, “Network Options”
for more about limiting
passive ports.
2. FTP Servers
Red Hat Enterprise Linux ships with two different FTP servers:
• Red Hat Content Accelerator — A kernel-based Web server that delivers high performance
Web server and FTP services. Since speed as its primary design goal, it has limited
functionality and runs only as an anonymous FTP server. For more information about
configuring and administering Red Hat Content Accelerator, consult the documentation
available online at
http://www.redhat.com/docs/manuals/tux/
.
•
vsftpd
— A fast, secure FTP daemon which is the preferred FTP server for Red Hat
Enterprise Linux. The remainder of this chapter focuses on
vsftpd
.
2.1.
vsftpd
The Very Secure FTP Daemon (
vsftpd
) is designed from the ground up to be fast, stable, and,
most importantly, secure. Its ability to handle large numbers of connections efficiently and
securely is why
vsftpd
is the only stand-alone FTP distributed with Red Hat Enterprise Linux.
The security model used by
vsftpd
has three primary aspects:
• Strong separation of privileged and non-privileged processes — Separate processes handle
different tasks, and each of these processes run with the minimal privileges required for the
task.
• Tasks requiring elevated privileges are handled by processes with the minimal privilege
necessary — By leveraging compatibilities found in the
libcap
library, tasks that usually
require full root privileges can be executed more safely from a less privileged process.
• Most processes run in a
chroot
jail — Whenever possible, processes are change-rooted to
the directory being shared; this directory is then considered a
chroot
jail. For example, if the
Chapter 15. FTP
278
Summary of Contents for ENTERPRISE LINUX 4.5.0 -
Page 1: ...Red Hat Enterprise Linux 4 5 0 4 5 0 Reference Guide ISBN N A Publication date ...
Page 2: ...Red Hat Enterprise Linux 4 5 0 ...
Page 4: ...Red Hat Enterprise Linux 4 5 0 ...
Page 24: ...xxiv ...
Page 26: ......
Page 36: ...12 ...
Page 72: ...48 ...
Page 112: ...88 ...
Page 122: ...98 ...
Page 140: ...116 ...
Page 142: ......
Page 300: ...276 ...
Page 318: ...294 ...
Page 320: ......
Page 332: ...308 ...
Page 350: ...326 ...
Page 378: ...354 ...
Page 388: ...364 ...
Page 394: ...370 ...
Page 395: ...Part IV Appendixes ...
Page 396: ......
