Understanding FTP service on the storage system

About the FTP service

By default, the FTP service is disabled on NetApp storage systems; however, you can enable it as discussed later in this chapter.

You do not require a license to enable this service on your storage system.

Components of the FTP service

The FTP service on the storage system comprises the following components:

FTP daemon
Authentication database
File access

The FTP daemon

The FTP daemon, ftpd, must be enabled to start the FTP service on the storage system. You can enable ftpd by configuring the ftpd.enable option. For information about how to enable this option, see Enabling the FTP service on your storage system.

Once enabled, ftpd listens on the standard FTP port 21 for FTP requests.

Authentication database for the FTP service

The database used to authenticate FTP clients depends on the authentication style you specify. You use the ftpd.auth_style option to specify the authentication style. The following three styles are available:

UNIX
NTLM
Mixed (Default)

For each of these styles, in addition to setting up specific users in the database, you can also set up an anonymous user. For information about setting up an anonymous user, see Anonymous FTP access options.

UNIX

For this style, you use the /etc/passwd file in the root volume of your storage system or the Network Information Service (NIS) server for authentication. You can also configure your storage system to use both databases at the same time.

If you want to set up local authentication on your storage system, you must use the /etc/passwd file. This file must contain the user name, password, UID, GID, and home directory information for each FTP client. The anonymous user ftp exists in the /etc/passwd file by default; however, to enable anonymous access to your storage system, you must configure the options as described in Anonymous FTP access options.

If you use NIS authentication, you must enable the nis.enable option on your storage system and have the users configured appropriately on the NIS server.

If you configure your storage system to use both databases at the same time, the order in which these databases get used is determined by the passwd map in the /etc/nsswitch.conf file. This file specifies a default order in which these databases are used; however, you can edit the file. For information on how to edit the /etc/nsswitch.conf file, see the Network Management Guide.

NTLM:

For this style, authentication goes through the Windows domain controller. This style offers a more secure authentication method than the UNIX style, because the user name and password are encrypted.

The format for the user name can be one of the following:

Domain\username
Username@domain
Username (If no domain is specified, the domain that the storage system is currently in is used.)

The home directory for each user is specified by a combination of the path specified in /etc/cifs_homedir.cfg and the user name. That is, the home directory is of the format cifs_homedir\username.

Note
The path specified in /etc/cifs_homedir is case-sensitive. The user name is not case-sensitive. For example, if the path is \home and user name is JOHN, the home directory for the user is \home\john.

In an NTLM environment, FTP users must be authenticated at the highest level of the directory structure in which their home directories are located. For example, if the user's home directory is /vol/vol1/home/user, they must have appropriate permissions for /vol/vol1 and /vol/vol1/home as well as for their home directory.

You can also set up anonymous (guest) access to your FTP server when using NTLM for authentication. For more information about anonymous access, see Configuring anonymous FTP access.

Mixed:

This style is used for authentication by default. The database used to authenticate an FTP client depends on the format of the user name specified at login time. If the user name is specified without a domain name, UNIX authentication style is used. If a domain name is specified with the user name in either domain\username or username@domain format, NTLM authentication style is used.

For example, if an FTP client specifies the user name as joe@doe, the NTLM authentication will be used; however, if the client specifies the user name joe, UNIX authentication will be used.

Anonymous FTP access options

By default, anonymous FTP access to the storage system is disabled. To enable anonymous FTP access, you must create a user account for Data ONTAP to use for anonymous users. The following table lists the options in Data ONTAP for setting up anonymous access to the storage system.

Option	Values (default)	Description
`ftpd.anonymous.enable`	On \| Off [Off]	Enables or disables `ftpd` daemon.
`ftpd.anonymous.name`	name_string [anonymous]	Enables you to change the default name (anonymous) used.
`ftpd.anonymous.home_dir`	pathname [] (null)	Specifies the directory to which the anonymous user will be mapped. Anonymous users can access only the directory specified by this option; authenticated users can access all volumes on the storage system, unless otherwise configured using the `ftpd.dir.restriction` option. When specifying a pathname for this option, you must first create the directory being specified. (Anonymous home directories are not created automatically.) The default anonymous user account must have read permission for this directory.

Option

Values (default)

Description

ftpd.anonymous.enable

On | Off [Off]

Enables or disables ftpd daemon.

ftpd.anonymous.name

name_string [anonymous]

Enables you to change the default name (anonymous) used.

ftpd.anonymous.home_dir

pathname [] (null)

Specifies the directory to which the anonymous user will be mapped.

Anonymous users can access only the directory specified by this option; authenticated users can access all volumes on the storage system, unless otherwise configured using the ftpd.dir.restriction option.

When specifying a pathname for this option, you must first create the directory being specified. (Anonymous home directories are not created automatically.) The default anonymous user account must have read permission for this directory.

Anonymous FTP authentication notes

Anonymous FTP for UNIX authentication

Although the /etc/passwd file contains a special entry, ftp, users must use the value specified in the ftpd.anonymous.name option for anonymous access. The home directory specified by the ftp entry in the /etc/passwd file is overridden by the ftpd.anonymous.home_dir option.

Anonymous FTP for NTLM authentication

The access privileges of a null user apply for anonymous access using NTLM.

Anonymous FTP for mixed authentication

The authentication style used for anonymous access depends upon the format of the user name specified.

File access permissions

The authentication mechanism used for FTP access only identifies an FTP client to the FTP server; it does not enable the client to access files in a qtree. The client must have appropriate qtree security permissions to access the files in a qtree. For more information about qtree security permissions, see the chapter about data organization using volumes and qtrees in the Storage Management Guide.

Prohibiting access to the FTP service

If you want to prohibit users from using the FTP service on your storage system, you can create a file named ftpusers in the /etc directory and include their user names. This file is not created automatically; you must create it in the /etc directory of your storage system. This file can be used for any authentication style. For more information about how to create this file and the information to include, see Denying access to the FTP service.

Other configurable FTP service options

The following table lists the other configurable options available for the FTP service.

Option	Values (default)	Description
`ftpd.dir.restriction`	none \| homedir	When you set this option to homedir, Data ONTAP restricts the access of named user accounts to their home directories (or to the override directory, if one is specified by the `ftpd.dir.override` option). When you set this option to none, Data ONTAP does not restrict the access of named user accounts to their home directories.
`ftpd.dir.override`	pathname [] (null)	When specifying a pathname for this option, you must create the directory being specified. (Override directories are not created automatically.) The default anonymous user account must have read access permissions for this directory.
`ftpd.idle_timeout`	number {s \| m \| h} [900s] Valid values are between 300s and 12h. Setting the value to 0 disables this option, that is, there will be no timeout on idle connections.	Specifies the time in seconds, minutes, or hours after which an idle connection is disconnected.
`ftpd.max_connections`	number [500]	Specifies the maximum number of concurrent FTP connections allowed. FTP requests received after this limit has been set will be refused, and the SNMP trap for this value (if it has been set) will be triggered. The upper limit for this value is 5000.
`ftpd.tcp_window_size`	number in bytes [32000]	Specifies the TCP window size, which specifies the amount of outstanding unacknowledged data a sender can send on a connection. Attention Setting this option inappropriately will adversely impact the FTP performance on your storage system. If you are unsure of the value to set, use the default value.

Concurrent FTP connection limitations

The number of available FTP connections depends upon the available storage system resources at runtime. Storage system services other than FTP may, upon high demand, reduce the maximum number of FTP connections to less than the default value (400) for ftpd.max_connections.

Each FTP action (such as ftpget and ftpput) may use one or two connections, depending upon the operation being performed.