By default, the FTP service is disabled on the filer; however, you can enable it as discussed later in this chapter.
You do not require a license to enable this service on your filer.
The FTP service on the filer comprises the following components:
The FTP daemon, ftpd, must be enabled to start the FTP service on the filer. You can enable ftpd by configuring the ftpd.enable option. For information about how to enable this option, see Enabling the FTP service on your filer.
Once enabled, ftpd listens on the standard FTP port 21 for FTP requests.
The database used to authenticate FTP clients depends on the authentication style you specify. You use the ftpd.auth_style option to specify the authentication style. The following three styles are available:
For each of these styles, in addition to setting up specific users in the database, you can also set up an anonymous user. For information about setting up an anonymous user, see Anonymous FTP access options.
For this style, you use the /etc/passwd file in the root volume of your filer or the Network Information Service (NIS) server for authentication. You can also configure your filer to use both databases at the same time.
If you want to set up local authentication on your filer, you must use the /etc/passwd file. This file must contain the user name, password, UID, GID, and home directory information for each FTP client. The anonymous user ftp exists in the /etc/passwd file by default; however, to enable anonymous access to your filer, you must configure the options as described in Anonymous FTP access options.
If you use NIS authentication, you must enable the nis.enable option on your filer and have the users configured appropriately on the NIS server.
If you configure your filer to use both databases at the same time, the order in which these databases get used is determined by the passwd map in the /etc/nsswitch.conf file. This file specifies a default order in which these databases are used; however, you can edit the file. For information on how to edit the /etc/nsswitch.conf file, see the Network Management Guide.
For this style, authentication goes through the Windows domain controller. This style offers a more secure authentication method than the UNIX style, because the user name and password are encrypted.
The format for the user name can be one of the following:
The home directory for each user is specified by a combination of the value specified for the cifs.home_dir option and the user name. That is, the home directory is of the format cifs.home_dir\username.
Note
The path specified by the cifs.home_dir option is case-sensitive. The user name is not case-sensitive. For example, if cifs.home_dir is \home and user name is JOHN, the home directory for the user is \home\john.
You can also set up anonymous (guest) access to your FTP server when using NTLM for authentication. For more information about anonymous access, see Configuring anonymous access to your filer.
This style is used for authentication by default. The database used to authenticate an FTP client depends on the format of the user name specified at login time. If the user name is specified without a domain name, UNIX authentication style is used. If a domain name is specified with the user name in either domain\username or username@domain format, NTLM authentication style is used.
For example, if an FTP client specifies the user name as joe@doe, the NTLM authentication will be used; however, if the client specifies the user name joe, UNIX authentication will be used.
By default, anonymous FTP access to the filer is disabled; however, you can enable it. The following table lists the options in Data ONTAP for setting up anonymous access to the filer.
For the UNIX authentication style, although the /etc/passwd file contains a special entry, ftp, the users must use the value specified by the ftpd.anonymous.name option for anonymous access. The home directory specified by the ftp entry in the /etc/passwd file is overridden by the ftpd.anonymous.home_dir option.
For the NTLM authentication style, the access privileges of a null user apply for anonymous access.
For the mixed authentication style, the authentication style used for anonymous access depends on the format of the user name specified.
The authentication mechanism used for FTP access only identifies an FTP client to the FTP server; it does not enable the client to access files in a qtree. The client must have appropriate qtree security permissions to access the files in a qtree. For more information about qtree security permissions, see the chapter about data organization using volumes and qtrees in the Storage Management Guide.
If you want to prohibit users from using the FTP service on your filer, you can create a file named ftpusers in the /etc directory and include their user names. This file is not created automatically; you must create it in the /etc directory of your filer. This file can be used for any authentication style. For more information about how to create this file and the information to include, see Denying access to the FTP service.
The following table lists the other configurable options available for the FTP service.
The number of available FTP connections depends upon the available filer resources at runtime. Filer services other than FTP may, upon high demand, reduce the maximum number of FTP connections to less than the default value (400) for ftpd.max_connections.
Each FTP action (such as ftpget and ftpput) may use one or two connections, depending upon the operation being performed.
Copyright © 1994-2003, Network Appliance, Inc. All rights
reserved.
Part No. 210-00473
File: ftp2.htm
Last updated: 11/25/03 18:02:56