This chapter includes tasks that are described in the following table to set up and administer an FTP server.Administering the FTP Server (Task Map) Controlling FTP Server Access Setting Up FTP Server Logins Customizing Message Files Controlling Access to Files on the FTP Server Controlling Uploads and Downloads on the FTP Server Virtual Hosting Starting the FTP Server Automatically Shutting Down the FTP Server Debugging the FTP Server Configuration Help for Busy Sites Task Description For Instructions Configure access to the FTP server Use the ftpaccess, ftpusers, and the ftphosts files in the /etc/ftpd directory to establish or restrict access to the FTP server. How to Set User Login LimitsHow to Control the Number of Invalid Login AttemptsHow to Disallow FTP Server Access to Particular UsersHow to Restrict Access to the Default FTP ServerHow to Define FTP Server Classes Set up FTP server logins Establish login accounts for real, guest and anonymous users. How to Set Up Real FTP UsersHow to Set Up Guest FTP UsersHow to Set Up Anonymous FTP UsersHow to Create the /etc/shells file Customize message files Edit the /etc/ftpd/ftpaccess file to configure the FTP server to return messages to the FTP client related to specific events. How to Customize Message FilesHow to Create Messages to Be Sent to UsersHow to Configure the README Option Configure access to files on the FTP server Use the /etc/ftpd/ftpaccess file to specify classes of users who are allowed to execute certain commands or to download and upload files to the FTP server. How to Configure DA Discovery for Dial-up NetworksControlling Uploads and Downloads on the FTP Server Enable limited or complete virtual hosting Use the /etc/ftpd/ftpaccess file to configure the FTP server to support multiple domains on the same machine. How to Enable Limited Virtual HostingHow to Enable Complete Virtual Hosting Start the FTP server Change the service properties to start the FTP server in nowait, standalone mode or foreground mode. How to Start an FTP Server Using SMFHow to Start a Standalone FTP Server in the BackgroundHow to Start a Standalone FTP Server in the Foreground Shut down the FTP server Use the /etc/ftpd/ftpaccess file and run the ftpshut to shut down the FTP server. Shutting Down the FTP Server Troubleshoot some common FTP server problems Check syslogd and use greeting text and log commands to debug problems on the FTP server. How to Check syslogd for FTP Server MessagesHow to Use greeting text to Verify ftpaccessHow to Check the Commands Executed by FTP Users You can use the following configuration files in the /etc/ftpd directory to control access to the FTP server. ftpusers is used to list users who are denied access to the FTP server. ftphosts is used to allow or deny login from various hosts to various accounts on the FTP server. ftpaccess is the main FTP configuration file. The FTP server only reads the /etc/ftpd/ftpaccess file if called with the -a option. When the ftpaccess file is used, all users must be members of a class to be allowed access to the FTP server. You can specify many ftpaccess directives that apply only to a particular class.For further information, see ftpusers4, ftphosts4, and ftpaccess4.In all FTP server configuration files, lines beginning with # signs are treated as comments. To log in to the FTP server, users must be members of a class when the ftpaccess file is used. To add the class directive to the ftpaccess file, you specify the class name, typelist of users who are permitted access from a particular host. &rolestepA;Add entries for anonymous, guest, and real users in the ftpaccess file.class class typelist addrglob[addrglob...]classKeyword that is used to define FTP users. classA name that is defined by the class keyword. Each login is compared against a list of defined classes. The logged in user is considered a member of the first class matched. typelistA comma-separated list of the keywords that match the three types of users: anonymous, guest, and real. addrglobA globbed domain name or a globbed numeric address. The addrglob can also be the name of a file, starting with a slash (`/`), which contains additional address globs: address:netmask or address/cidr.Here are some examples of globbed addresses:Numeric IPv4 address: 10.1.2.3 Globbed domain name *.provider.com Globbed numeric IPv4 address 10.1.2.* Numeric IPv4 address:netmask 10.1.2.0:255.255.255.0 Numeric IPv4 address/CIDR 10.1.2.0/24 Numeric IPv6 address: 2000::56:789:21ff:fe8f:ba98 Numeric IPv6 address/CIDR: 2000::56:789:21ff:fe8f:ba98/120 class local real,guest,anonymous *.provider.com class remote real,guest,anonymous *The previous example defines the local class as any user of the type real, guest, or anonymous who logs in from *.provider.com. The last line defines remote as any user who logs in from anywhere other than *.provider.com. You can limit the number of simultaneous logins by users of a certain class with directives that are set in the ftpaccess file. Each login limit contains the name of a class, a UUCP-style days-of-week list, and a message file to display if the limit is exceeded.To set user login limits, follow the steps in the next procedure. &rolestepA;Add the following entries to the ftpaccess file:limit class n times [message-file]limitKeyword that is used to restrict simultaneous logins by the specified number of users of a defined class at certain connection times. classA name that is defined by the class keyword. Each login is compared against a list of defined classes. The logged-in user is considered a member of the first class matched. nNumber of users. timesDay-of-week and time-of-day when the class can connect. Use Any for any day. message-fileMessage file that is displayed if a user is denied access. limit anon 50 Wk0800-1800 /etc/ftpd/ftpmsg.deny limit anon 100 Any /etc/ftpd/ftpmsg.deny limit guest 100 Any /etc/ftpd/ftpmsg.denyThe first line of the preceding example shows a limit of 50 simultaneous logins that are allowed to users of class anon during weekly work hours. The second line limits anon users to 100 simultaneous logins outside of working hours. The last line shows a limit of 100 guest logins that are allowed at any time. For information on how to specify day and time parameters, see ftpaccess4.The example further indicates that the content of the file /etc/ftpd/ftpmsg.deny is returned when a specified login limit is reached, assuming ftpmsg.deny exists. For information on using the /usr/sbin/ftpcount command to view the number and login limit for each class of user who is logged in at a particular time, see ftpcount1.Users are allowed login to the FTP server unless a specified limit is reached. Anonymous users are logged in as the user ftp. Real users are logged in as themselves, and guests are logged in as real users with a chroot environment to limit access privileges.For information on using the /usr/sbin/ftpwho command to check the identities of the users logged into the FTP server, see ftpwho1. If a login to the FTP server fails because of a problem such as misspelling required information, login is usually repeated. The user is allowed a specific number of consecutive login attempts before a message is logged to the syslog file. At that point, the user is disconnected. You can set a failure limit on the number of login attempts by following steps in the next procedure. &rolestepA;Add the following entries to the ftpaccess file.loginfails nloginfailsKeyword that is used to assign the number of login failures that are permitted before the FTP connection is terminated nNumber of times a login can fail loginfails 10The preceding example states that the user is disconnected from the FTP server after 10 failed login attempts. The /etc/ftpd/ftpusers file lists names of users who are not allowed to log in to the FTP server. When login is attempted, the FTP server checks the /etc/ftpd/ftpusers file to determine whether the user should be denied access. If the user's name is not found in that file, the server then searches the /etc/ftpusers file. If the user's name is matched in /etc/ftpusers, a syslogd message is written with a statement that the match was found in a deprecated file. The message also recommends the use of /etc/ftpd/ftpusers instead of /etc/ftpusers.Support for the /etc/ftpusers file has been deprecated in this release. If the /etc/ftpusers file exists when the FTP server is installed, the file is moved to /etc/ftpd/ftpusers. For additional information, see syslogd1M, in.ftpd1M, and ftpusers4 &rolestepA;Add entries to the /etc/ftpd/ftpusers file for users who are not allowed to log in to the FTP server. root daemon bin sys adm lp uccp nuucp listen nobody noaccess nobody4The previous example lists the typical entries in the ftpusers file. User names match entries in the /etc/passwd. The list generally includes the root and other administrative and system application identities.The root entry is included in the ftpusers file as a security measure. The default security policy is to disallow remote logins for root. The policy is also followed for the default value that is set as the CONSOLE entry in the /etc/default/loginfile. See login1. In addition to the controls mentioned previously, you can add explicit statements to the ftpaccess file to restrict access to the FTP server. &rolestepA;Add the following entries to the ftpaccess file.By default, all users are allowed access to the default (non-virtual) FTP server. To deny access for specific users (other than anonymous), add the following entry:defaultserver deny username [username...]defaultserverKeyword that is used to identify the non-virtual server to which access can be denied or allowed usernameLogin name of a user with restricted access to the defaultserver To allow access for users who are not listed on the deny line, add the following line:defaultserver allow username [username...] To prevent access by anonymous users, add the entry: defaultserver private defaultserver deny * defaultserver allow usernameThe previous example states that the FTP server denies access to all users except anon users and those users who are listed on the allow line.You can also use the ftphosts file to deny access to particular login accounts from various hosts. See ftphosts4 for additional information. To access an FTP server, you must first log in. The FTP server supports three types of user login accounts for real, guests, and anonymous users.Real users have accounts that allow them to establish terminal sessions on systems that run the FTP server. Subject to directory and file access permissions, the entire disk structure is visible to real users. Guest users also need accounts to log in to the FTP server. Each guest account is set up with a user name and password. Functioning login shells are not assigned to guests to prevent users from establishing terminal sessions. At login, the FTP server performs a chroot2 operation to restrict a guest's view of the server's disk structure.Login shells for real and guest users must be listed in the /etc/shells file to allow access to the FTP server. Anonymous users log in to the FTP server by using the either ftp or anonymous as a user name. By convention, anonymous users supply an email address when prompted for a password.At login, the FTP server performs a chroot2 operation that restricts the anonymous user's view of the server's disk structure. A single file area is shared by all anonymous users, unlike the separate areas that can be created for each guest user.Real and guest users log in by using individual accounts with passwords that are known only to one person. Anonymous users log in to a well-known account that is potentially available to anyone. Most large-scale file distribution is created by using the anonymous account. To enable access for real users to the FTP server, follow these instructions: Verify that the user has an account that is set up with a user name and password that can be used to establish a terminal session.For more information, see Chapter 4, Managing User Accounts and Groups (Overview), in System Administration Guide: Basic Administration. Confirm that the real user is a member of a class in the ftpaccess file.For information on the user classes that are defined in the ftpaccess file, see How to Define FTP Server Classes. Verify that the user's login shell is listed in the /etc/shells file. The ftpconfig script is used to copy all necessary system files to the home directory. When the guest user and the guest's home directory already exist, the ftpconfig script updates the area with the current system files.For more information, see ftpconfig1MUnlike the user name (anonymous or ftp) that is set for anonymous users, user names for FTP guests are not fixed. Any name that would work as a real user name can be selected. To enable access by a guest user to the FTP server, do the following: Use the useradd script to create a guest user account with a login shell of /bin/true and a home directory of /root-dir/./home-dir. For more information, see useradd1M and Chapter 4, Managing User Accounts and Groups (Overview), in System Administration Guide: Basic Administration.In this procedure, /home/guests/./guest1 is used as the home directory name for a user who is called guest1. # /usr/sbin/useradd -m -c "Guest FTP" -d \ /home/guests/./guest1 -s /bin/true guest1 Assign a password to the guest account. Add a guestuser entry to the ftpaccess file.guestuser guest1You can also use the guestgroup capability in the ftpaccess file to specify guest users. The guest-root capability in ftpaccess eliminates the need for the /./ in the guest user's home directory path. Confirm that the guest user is a member of a class in the ftpaccess file. See How to Define FTP Server Classes for further information. Use the ftpconfig script to create the required files in the chroot area./usr/sbin/ftpconfig -d /home/guests Confirm that /bin/true is listed in the /etc/shells file. See How to Create the /etc/shells file. In this example, the FTP area is set up in the /home/guests directory.# /usr/sbin/ftpconfig -d /home/guests Updating directory /home/guests The ftpconfig script creates the anonymous user account and populates the home directory with the required files.For more information, see ftpconfig1M.To enable access by an anonymous user to the FTP server, follow these instructions: Use the ftpconfig script to create the anonymous user account. /usr/sbin/ftpconfig anonymous-ftp-directory Confirm that the anonymous user is assigned to a class in the ftpaccess file. See How to Define FTP Server Classes for further information. In this example, the FTP area is set up in the /home/ftp directory.# /usr/sbin/ftpconfig /home/ftp Creating user ftp Updating directory /home/ftp &rolestepA;Create the /etc/shells file. Edit /etc/shells. Add the full path to each shell on a single line. The following is an example of an /etc/shells file with a /bin/true listed for FTP guest users:/sbin/sh /bin/csh /bin/jsh /bin/ksh /bin/remsh /bin/rksh /bin/rsh /bin/sh /usr/bin/csh /usr/bin/ksh /usr/bin/bash /usr/bin/tcsh /usr/bin/zsh /bin/true You can configure the FTP server to return messages that are related to specific events to the FTP client. A welcome message might be set to display when a user logs in to the FTP server. Another message could appear when the user makes a directory change.In addition to plain text, message files can contain one or more magic cookies. A magic cookie is composed of a % (percent sign), followed by a single character. When you embed a cookie in message text, information that is associated with the cookie appears on screen at the point the message file is called.For example, message text might contain the cookie %L:Welcome to %L! When the message is displayed, the magic cookie %L is replaced with the name of the server as defined by the hostname statement in the ftpaccess file. For a complete list of supported message cookies, see ftpaccess4.If the host name is not defined in the ftpaccess file, the default host name for the local machine is used. &rolestepA;Edit your message file to include magic cookies as appropriate. See ftpaccess4 for a list of cookies you can use. The following is an example of a message file that includes magic cookies:Welcome to %L -- local time is %T. You are number %N out of a maximum of %M. All transfers are logged. If your FTP client crashes or hangs shortly after login please try using a dash (-) as the first character of your password. This will turn off the informational messages that may be confusing your FTP client. Please send any comments to %E. After the user is logged in, system-related or application-related messages are displayed on screen. The ftpaccess file lists the events that trigger associated message statements. &rolestepA;Add the following entries to the ftpaccess file:message message-file [when [class ...]]messageKeyword that is used to specify the message file to be displayed when a user logs in or executes the command to change the working directory. message-fileName of the message file to be displayed. whenParameter that is set as login or cwd=dir. See the following example. classThe class specification allows the message to be displayed only to members of a particular class. message /etc/ftpd/Welcome login anon guest message .message cwd=* The preceding example states that the file /etc/ftpd/Welcome is displayed at login for users of the class anon or guest. The second line states that the .message file in the current working directory is displayed for all users.Message files are created relative to the chroot directory for guest and anonymous users. The first time a directory is visited, README files can be listed. To configure the README option, add the following entries to the ftpaccess file. &rolestepA;Add the following entries to the ftpaccess file.readme message-file [when [class...]]readmeKeyword that is used to specify a message file to be checked when a user logs in or changes the working directory. If the message file exists, the user is notified and is given the date the file was modified. message-fileName of the message file to be checked. whenParameter that is set as login or cwd=dir. See the following example. classThe class specification allows the message to be displayed only to members of a particular class. The greeting and banner keywords can also be used to send messages to users. See ftpaccess4. readme README* login readme README* cwd=* The previous example states that any files that match README* are listed at login or when a directory is changed. Here is a sample login that is based on the settings that are used in that example.% ftp earth Connected to earth. 220 earth FTP server ready. Name (earth:rimmer): ftp 331 Guest login ok, send your complete e-mail address as password. Password: 230- 230-Welcome to earth -- local time is Thu Jul 15 16:13:24 1999. 230- 230-You are number 1 out of a maximum of 10. 230-All transfers are logged. 230- 230-If your FTP client crashes or hangs shortly after login please try 230-using a dash (-) as the first character of your password. This will 230-turn off the informational messages that may be confusing your FTP 230-client. 230- 230-Please send any comments to ftpadmin@earth. 230- 230 Guest login ok, access restrictions apply. ftp> cd pub 250-Please read the file README 250- it was last modified on Thu Jul 15 16:12:25 1999 - 0 days ago 250 CWD command successful. ftp> get README /tmp/README 200 PORT command successful. 150 Opening ASCII mode data connection for README (0 bytes). 226 ASCII Transfer complete. ftp> quit 221 Goodbye. The FTP server access controls in this section supplement the standard file and directory access controls available with the Solaris release. Use the standard Solaris commands to restrict who can access, change, or upload files. See chmod1, chown1, and chgrp1.To use the permission capabilities in ftpaccess to specify what type of user is allowed to perform which commands, do the following: &rolestepA;Add the following entries to the ftpaccess:command yes|no typelistcommandThe commands chmod, delete, overwrite, rename, or umask yes|noAllows or disallows a user to issue a command typelistA comma-separated list of any of the keywords anonymous, guest, and real The following are examples of permissions that are set for file access functions on FTP server.chmod no anonymous, guest delete no anonymous overwrite no anonymous rename no anonymous umask no guest, anonymousThe preceding example states the following:Anonymous users are not allowed to delete, overwrite, or rename files. Guests and anonymous users are both prevented from changing access modes and resetting the umask. You can control uploads and downloads that are started to and from the FTP server by setting permissions on directories on the server. By default, uploads are not allowed for anonymous users. Be very careful when enabling anonymous uploads.Add the directives to the ftpaccess file to specify upload permissions and error messages for upload failures. &rolestepA;Add the following entries to the ftpaccess file.To enable users to upload files, add the following entry:upload [absolute|relative] [class=<classname>]... [-] root-dir \ dirglob yes|no owner group mode [dirs|nodirs] [<d_mode>] path-filter typelist mesg allowed-charset {disallowed regexp...}uploadKeyword that is applied to users who have a home directory (the argument to chroot) of the root-dir. The root-dir can be specified as “*” to match any home directory. absolute|relativeParameter that specifies whether the root-dir directory paths are interpreted as absolute or relative to the current chroot directory. classKeyword that is used to specify any number of class=<classname> restrictions. If restrictions are specified, the upload clause only becomes effective if the current user is a member of one of the specified classes. root-dirUser's root directory and the home directory for anonymous users. dirglobA pattern to match a directory name. An asterisk can be used in any place or alone to signify any directory. yes|noVariable that allows or disallows upload to the FTP server. ownerOwner of files that are uploaded into dirnames. groupGroup that is associated with files that are uploaded into dirnames. modeParameter that is used to specify access permissions for uploaded files. The default mode 0440 prevents the anonymous account from reading uploaded files. dirs|nodirsKeyword that allows or disallows users to create subdirectories in a directory that is listed in dirnames. d_modeOptional mode that determines the permissions for a newly created directory. path-filterKeyword that controls the names of uploaded files. typelistA comma-separated list of any of the keywords anonymous, guest, and real. mesgMessage file that is displayed fails to match the regexp criteria. allowed-charset {disallowed regexp...}Alphanumeric characters allowed or disallowed in file names. upload /export/home/ftp /incoming yes ftpadm ftpadmin 0440 nodirs path-filter anonymous /etc/ftpd/filename.msg ^[-A-Za-z0-9._]*$ ^[.-]The preceding example states the following:FTP user accounts that use chroot to /export/home/ftp can upload to the /incoming directory. Uploaded files are owned by user ftpadm and the group ftpadmin. The mode is set to 0440 with the nodirs keyword to prevent anonymous users from creating subdirectories. For anonymous users, a file name is any sequence of A-Z, a-z, 0-9, . (dot), - (dash), or _ (underline). File names cannot start with a . (dot) or - (dash). If a file name fails this filter, the /etc/ftpd/filename.msg message is displayed if the FTP Administrator has created the message file. This message is followed by an FTP server error message. Ownership and permissions on a directory into which anonymous uploads are allowed should be tightly controlled. The FTP Administrator should be the owner of all files uploaded to the FTP server. You need to create an FTP Administrator when anonymous users are allowed to upload files. The directory should be owned by the user ftpadm and group ftpadm with permissions set to 3773.The access mode for files uploaded to the FTP server should be 0440. The 0440 mode prevents the anonymous account from reading uploaded files. This restriction protects your server from becoming a staging area for third-party file distribution.To make uploaded files available for distribution, the FTP Administrator can move files to a public directory. &rolestepA;Add the following entries to the ftpaccess file to prevent users from retrieving files.noretrieve [absolute|relative] [class=classname]... [-] filename ...noretrieveKeyword that is used to deny retrieval of a particular file or files absolute|relativeParameter that specifies whether the root-dir directory paths are interpreted as absolute or relative to the current chroot directory classKeyword that is used to specify class=<classname> of users to which noretrieve restrictions apply filenameName of file the user is not permitted to retrieve noretrieve /etc/passwdThe preceding example states that all users are prevented from retrieving the /etc/passwd file. Virtual hosting allows the FTP server to support multiple domains on the same machine. Each virtual host requires a separate logical interface and IP address.The FTP server supports two types of virtual hosting: limited and complete. With limited virtual hosting, the same configuration files are used for all virtual hosts. With complete virtual hosting, separate configuration files can be used for each virtual host.By default, real and guest users are not allowed to log in to virtual hosts. You can set the following ftpaccess directives to override the default.To allow access to specific users: virtual address allow username To deny access to anonymous users: virtual address private username See ftpaccess4 for further information.Limited virtual hosting provides partial support for virtual FTP servers. You can enable support for limited virtual hosting by specifying the virtual root directory. If required, you can also set the following parameters for the virtual host in the ftpaccess file:banner logfile email hostname All directives in the ftpaccess file are shared globally across all virtual servers. &rolestepA;Add the following entries to the ftpaccess file.virtual address root|banner|logfile path virtual address hostname|email stringvirtualKeyword that is used to enable virtual server capabilities addressIP address of the virtual server rootThe root directory of the virtual server bannerBanner file that is displayed when a connection is made to the virtual server logfileRecord of file transfers that are made to and from the virtual server pathVariable that is used to specify the location of directories and files on the virtual server emailEmail address that is used in message files and in the HELP command hostnameName of the host that is shown in the greeting message or status command stringVariable that is used to specify email or hostname parameters While it is possible to use hostname as the address of the virtual server, you are strongly encouraged to use the IPv4 address instead. DNS must be available when the FTP connection is received in order for hostname to be matched. For an IPv6 host, use the host name rather than the IPv6 address. virtual 10.1.2.3 root /var/ftp/virtual/ftp-serv virtual 10.1.2.3 banner /var/ftp/virtual/ftp-serv/banner.msg virtual 10.1.2.3 logfile /var/log/ftp/virtual/ftp-serv/xferlogThe preceding example sets the location of the root directory, banner, and logfile on a virtual FTP server. The ftpaddhost1M script with the l option is provided to configure limited virtual hosts.In the following example, ftpaddhost is run with l b x options to configure limited virtual hosting with a test banner and the logfile /var/ftp/virtual/10.1.2.3/xferlog under a virtual root /var/ftp/virtual/10.1.2.3.# ftpaddhost -l -b -x /var/ftp/virtual/10.1.2.3/xferlog \ /var/ftp/virtual/10.1.2.3 Complete virtual hosting allows separate configuration files for each virtual domain. To enable complete support for virtual hosting on the FTP server, you can create or modify the following FTP configuration files for specific domains: ftpaccess ftpusers ftpgroups ftphosts ftpconversions For further information, see ftpaccess4, ftpusers4, ftpgroups4, ftphosts4, and ftpconversions4.If separate versions of the configuration files are unavailable, master versions of the files in the /etc/ftpd directory are used. &rolestepA;Add the following entry to the /etc/ftpd/ftpservers file.address /config-file-diraddressIP address of the virtual server config-file-dirDirectory that contains the configuration files that are customized for the virtual host While it is possible to use hostname as the address of the virtual server, you are strongly encouraged to use the IPv4 address instead. DNS must be available when the FTP connection is received in order for hostname to be matched. For an IPv6 host, use the host name rather than the IPv6 address. To create a customized version of an FTP server configuration file for the virtual host, copy the master version of the file from /etc/ftpd to the /config-file-dir directory.For further information, see ftpservers4. # # FTP Server virtual hosting configuration file # 10.1.2.3 /net/inet/virtual/somedomain/ 10.1.2.4 /net/inet/virtual/anotherdomain/The preceding example specifies the IP addresses for two different domains on the virtual server. The ftpaddhost1M script with the c option is provided to configure complete virtual hosts.In the following example, ftpaddhost is run with c b x options to configure complete virtual hosting with a test banner and the logfile /var/ftp/virtual/10.1.2.3/xferlog under a virtual root /var/ftp/virtual/10.1.2.3.# ftpaddhost -c -b -x /var/ftp/virtual/10.1.2.3/xferlog \ /var/ftp/virtual/10.1.2.3 The FTP server can be started in one of three ways:As a nowait server that is started by inetd As a standalone server run in the background As a standalone server run in the foreground from the inittab file A standalone server always has the quickest possible response time, and is intended for large servers that are dedicated to providing FTP service. The standalone server provides low connection latency for dedicated servers because the standalone system never has to be restarted. The standalone server is always running, even during off-peak hours, waiting indefinitely for connections.By default, the SMF service is configured to start the FTP server using the nowait mode. If the site handles many connections, the FTP server can also be run in standalone mode. See the in.ftpd1M man page for information on additional command-line options. &rolestepA;Verify the wait property for the FTP server.The line reporting that wait=FALSE indicates that the server is started in nowait mode.# inetadm -l network/ftp SCOPE NAME=VALUE name="ftp" endpoint_type="stream" proto="tcp6" isrpc=FALSE wait=FALSE exec="/usr/sbin/in.ftpd -a" user="root" default bind_addr="" default bind_fail_max=-1 default bind_fail_interval=-1 default max_con_rate=-1 default max_copies=-1 default con_rate_offline=-1 default failrate_cnt=40 default failrate_interval=60 default inherit_env=TRUE default tcp_trace=FALSE default tcp_wrappers=FALSE Start the FTP server.# svcadm enable network/ftp &rolestepA;Disable the FTP server.# svcadm disable network/ftp Start the standalone FTP server.# /usr/sbin/in.ftpd -a -SAdd the line to an FTP server startup script. See Using Run Control Scripts in System Administration Guide: Basic Administration for information on creating a system startup script. &rolestepA;Disable the FTP server.# svcadm disable network/ftp Add an entry to the inittab file to start the service.The new entry in /etc/inittab should look something like the following:ftpd:3:respawn:/usr/sbin/in.ftpd -a -s Tell init to re-examine /etc/inittab.This command should start the FTP service.# init q The ftpshut1M command closes down the FTP server at a particular time.When you run ftpshut, a file is generated from command-line options that specify when shutdown occurs, the point at which new connections are refused, and when existing connections are dropped. Users are notified of a server shutdown based on this information. The location of the file that is created by ftpshut is specified by the shutdown directive in the ftpaccess file.Follow the steps in this procedure to run ftpshut and to add the shutdown directive to the ftpaccess file. &rolestepA;Add the following entries to the ftpaccess file.shutdown pathshutdownKeyword that is used to specify the path to a file that is checked regularly for whether the FTP server is scheduled to be shut down pathLocation of the file that was created by ftpshut command Run the ftpshut command.ftpshut [ -V ] [ -l min] [ -d min] time [warning-message...]ftpshutCommand that provides a procedure for notifying users that the FTP server is shutting down. -VOption that is specified to display copyright and version information, then terminate -lFlag that is used to adjust the time that new connections to the FTP server are denied -dFlag that is used to adjust the time that existing connections to the FTP server are disconnected. timeShutdown time that is specified by the word now for immediate shutdown, or in one of two formats (+ number or HHMM) for a future shutdown [warning-message...]Shutdown notification message Use the ftprestart command to restart the FTP server after shutdown.For further information, see ftpshut1M, ftpaccess4, and ftprestart1M. This section describes some of the ways to debug problems with the FTP server.The FTP server writes messages that are useful for debugging to the location that is specified for daemon messages in the /etc/syslog.conf file. If a problem occurs with the FTP server, check this file first for such messages.The FTP server messages are controlled by facility daemon and level information. To send messages from the FTP server to /var/adm/message and have syslogd reread its configuration file, follow these instructions: Add an entry such as the following to the /etc/syslog.conf file.daemon.info /var/adm/message Signal syslogd to reread its configuration.# svcadm refresh system/system-logThis action causes informational messages from the FTP Sever to be written to /var/adm/messages. To use the greeting text capability to check that the correct ftpaccess file is being used, do the following: Add the following directive to the ftpaccess file.greeting text message Connect to the FTP server. If the message fails to appear, do the following:Confirm that the ftpaccess file is in the correct location. Use the strings1 command to obtain the location of the file from the FTP server binary.# strings /usr/sbin/in.ftpd | grep "^/.*ftpaccess" Check the ftpservers file to see if virtual hosting has been configured.For further information, see ftpaccess4, ftpservers4, strings1, syslog.conf4, and pgrep1. To see what commands are being executed by FTP users, use the log commands logging capability in ftpaccess. Add the following directive to the ftpaccess file to log individual commands by users who are specified in typelist.log commands typelist Check messages that are written to the location specified in the /etc/syslog.conf. The following list includes some suggestions to improve performance on busy FTP sites.Sites which typically support many simultaneous connections should run the FTP server in standalone mode, see Starting the FTP Server Automatically. Use vmstat and other system utilities to monitor the system hosting the FTP server. If the system runs low on resources place a limit on the number of simultaneous connections, see How to Set User Login Limits. For more information on system monitoring, see Chapter 20, Monitoring System Performance (Tasks), in System Administration Guide: Advanced Administration. If you impose a connection limit, consider using the limit-time and timeout idle capabilities in the ftpaccess file to stop users from hogging connections. If you don't impose a connection limit, specify the Q option to in.ftpd. If you don't need ftp login and logout records in /var/adm/wtmpx, specify the W option to in.ftpd. To reduce the load on the system hosting the FTP server, increase the transfer buffer sizes using the recvbuf and sendbuf capabilities in the ftpaccess file. If large buffer sizes are selected it may be necessary to increase the data activity timeout using the timeout data capability in the ftpaccess file. The FTP server reads from various databases including the hosts, passwd, group and services. Slow lookups may cause a significant delay logging into the FTP server, configuring the files source first in nsswitch.conf minimizes the lookup times. For more information, see the nsswitch.conf4 man page. By default the FTP server attempts to lookup the remote host's name, which can be slow causing a significant delay logging in. The rhostlookup capability in the ftpaccess file can be used to stop this lookup. However be aware that if the remote host's name is not looked up, only its IP address is matched when using other capabilities in the ftpaccess file and when matching entries in the ftphosts file. Also the remote host's IP address will be used in messages and in place of the %R magic cookie. See the description of the rhostlookup capability in the ftpaccess4 man page for more details. Retrieving quota information may also cause a significant delay when logging into the FTP server, so only use the quota-info capability in the ftpaccess file if you make use of the quota magic cookies. See the ftpaccess4 man page for a list of the quota magic cookies.