File manager - Edit - /var/www/payraty/helpdesk/public/storage/branding_media/images/vsftpd.tar
Back
etc/init.d/vsftpd 0000755 00000004023 00000000000 0007700 0 ustar 00 #!/bin/sh ### BEGIN INIT INFO # Provides: vsftpd # Required-Start: $network $remote_fs $syslog # Required-Stop: $network $remote_fs $syslog # Default-Start: 2 3 4 5 # Default-Stop: 0 1 6 # Short-Description: Very secure FTP server # Description: Provides a lightweight, efficient FTP server written # for security. ### END INIT INFO set -e DAEMON="/usr/sbin/vsftpd" NAME="vsftpd" PATH="/sbin:/bin:/usr/sbin:/usr/bin" LOGFILE="/var/log/vsftpd.log" CHROOT="/var/run/vsftpd/empty" test -x "${DAEMON}" || exit 0 . /lib/lsb/init-functions if [ ! -e "${LOGFILE}" ] then touch "${LOGFILE}" chmod 640 "${LOGFILE}" chown root:adm "${LOGFILE}" fi if [ ! -d "${CHROOT}" ] then mkdir -p "${CHROOT}" fi case "${1}" in start) log_daemon_msg "Starting FTP server" "${NAME}" if [ -e /etc/vsftpd.conf ] && ! egrep -iq "^ *listen(_ipv6)? *= *yes" /etc/vsftpd.conf then log_warning_msg "vsftpd disabled - listen disabled in config." exit 0 fi start-stop-daemon --start --background -m --oknodo --pidfile /var/run/vsftpd/vsftpd.pid --exec ${DAEMON} n=0 while [ ${n} -le 5 ] do _PID="$(if [ -e /var/run/vsftpd/vsftpd.pid ]; then cat /var/run/vsftpd/vsftpd.pid; fi)" if ps -C vsftpd | grep -qs "${_PID}" then break fi sleep 1 n=$(( $n + 1 )) done if ! ps -C vsftpd | grep -qs "${_PID}" then log_warning_msg "vsftpd failed - probably invalid config." exit 1 fi log_end_msg 0 ;; stop) log_daemon_msg "Stopping FTP server" "${NAME}" start-stop-daemon --stop --pidfile /var/run/vsftpd/vsftpd.pid --oknodo --retry 30 --exec ${DAEMON} RET=$? if [ $RET = 0 ]; then rm -f /var/run/vsftpd/vsftpd.pid; fi log_end_msg $? ;; restart) ${0} stop ${0} start ;; reload|force-reload) log_daemon_msg "Reloading FTP server configuration" start-stop-daemon --stop --pidfile /var/run/vsftpd/vsftpd.pid --signal 1 --exec $DAEMON log_end_msg "${?}" ;; status) status_of_proc "${DAEMON}" "FTP server" ;; *) echo "Usage: ${0} {start|stop|restart|reload|status}" exit 1 ;; esac usr/share/bug/vsftpd 0000755 00000002512 00000000000 0010431 0 ustar 00 #!/bin/bash cat <<EOF Providing additional information can help diagnose problems with vsftpd. Specifically, this would include: - The system vsftpd log file. - The /etc/vsftpd.conf file. If this information is not relevant for your bug report or you have privacy concerns, please choose no. EOF yesno "Do you want to provide additional information [Y|n]? " yep [ "$REPLY" = yep ] || exit 0 REPORTBUG_VERSION=$(dpkg-query -f '${source:Version}' -W reportbug) LOG_FILE='/var/log/vsftpd.log' CONF_FILE='/etc/vsftpd.conf' # Depending on whether reportbug is new enough, we either write the output of # our various commands to a file and attach them to the report (this needs # reportbug ≥ 6.5.0) or just write them to the body of the bug report. if dpkg --compare-versions "$REPORTBUG_VERSION" ge "6.5.0"; then # We don’t clean up this directory because there is no way to know when # reportbug finished running, and reportbug needs the files around. # Given that those are just a couple of kilobytes in size and people # generally don’t file a lot of bugs, I don’t think it’s a big deal. DIR=$(mktemp -d) echo "-- BEGIN ATTACHMENTS --" >&3 # # attach conf & log # if [ -f ${CONF_FILE} ] ; then cp ${CONF_FILE} ${DIR} echo ${DIR}/vsftpd.conf >&3 fi echo "-- END ATTACHMENTS --" >&3 fi SECURITY/OVERVIEW 0000644 00000000746 00000000000 0007154 0 ustar 00 The documents in this directory contain information about the security of vsftpd. They explain why various aspects of vsftpd were coded the way they are. File Contents DESIGN Comments on the overall architecture of vsftpd, from a security standpoint. IMPLEMENTATION Comments on steps taken to ensure a secure implementation. TRUST Comments on external components trusted or distrusted by vsftpd. SECURITY/DESIGN.gz 0000644 00000006071 00000000000 0007273 0 ustar 00 � �Y]s�}ǯ��EҔb7}p:}�e�QG�x"���ID��v�%��s. r)���㱩���{.�uQ���z듶�Cg��:m�nmt�7�tQ��A��ze�vq��v��#^w��d|cuXk��m������(u�jƮ����&�v�3Z<�Mh��~`��!��<Yݻ��\U��}��_\Y�mcc4�a�߭��麅v^|5�h���1lF��o��0bs�ڥ�l�֭������6�e��^#�f��XF�W�F�&o������;�]kM��_H������!=�W�]��;�����,� �j3�.��W��1�`����zo:��ۨm�ད5ؗ��-�����i�R��vgDž�[�5;ˀl&���xψb��;d�1��2�y����z���Ѧy�a��vc3(��[���hL�u� 8ݶy#qJeCc��!=�Ýhe�c"��g�X˼����a�sa��>� �y��h�/�L0:9�Cw( p�qeQgML �v���8m��>�S��ؙ1q�B�zۻ����Mb�mse�a�"̞��R��U��Ǽ2���:���!g��!�V�4j����O.���lEsGxN��D�Ȓ:��=⟬_���P0�� ��~�����0�n֮��G:�(G�ǩ���#D(�0%Э���)vB�ǝkX,�v�ou6<k�Ga��� ��"�l~�E>�sQO��7�|�O��ť~���F� /a�a�QҜ��(�I�p�i 7��b��!g��� �/ �H� Ra�0�b)�I� ].C�R�'lۄ�J�H�L�����7��E��Č�X���Q� l��i�jڨ�N��wo߾�ʔc�X�����@��>�*��3�P7iK��`�A�,6G<�T����.Ľ�����$��2�����`Z� ��?�D�M�)�!�b��9�?�3�R��?���x�e��~�s��֚����$³e�7�����+� RJ���i�u���`�� z�3_��PW�E��n�:GZ�:T�'�:���/�� K}�<��17����p� �=�RW�0wT�M�q�ޔ#M#�+�:E�T��%�\���g�Mh�OmSs�Ф���� Yr�g�ϒ���g�d�#(���QN�fK�����u��Z�N����A�k� �i�u%���<x�N�N1�.j/�ddili�:煔,������'P�-�8����&2��;��9�A̾��E���8OL�˹J-�#7�BNb�����H�x��,�4�n�̓Ƿ�0�$L-�d*�1fYY���6�Nȅ�Y�l�%{ԕ^��qF�u!7��<r��`���eg���=8�2���gٴz�ʍ�\��� (����G}�Q[3HVC�d�`Hq�/��@cvTmJv��6�q�=;ka�]@�@� ���r��յ���� /�lG(����9�4dVA��j�̒9)�r#$�"Xek�"�O�҂tSe�Wn��uBA�����$��2>�+�V[�H2D���� 8�5d<�,�f�py�T�$(�_2ɣ0E �f�X\ ���{e�s E��h�����Z:���(<'љҋ�`��� r��:Q�V�3uPǯ����Rߣ��x ������m��Ek��%�:ձ+H��C�3�ER Ӫs %z��Ba]i갅��~H��B���Q2Rյ�����k����:��%07��ݡ�N�q�S��N�����#E�c8$�h�� ĉݤ Ɣ��1A���d �$r ����U��䄡ZNI.ne����8bNhd��d��ƒ���AC���b���l$�UY垽� �^�7q���Cc��%b�j#�mw!s��[�3u�%�e������[�GeNU��nE�@��"��9�D���n�`V�w^�9?=�7�7B��Q��8q����� ��VB���<%�;�_?�X��}H�a}6�,�YE8s��[���2�s�=Xori���e�G�U���,���X�7�\\�h���^�fu�����ztnX��� �:����Y#�r�1u���� #��s��y�T<#Z�&�9�cf{�*��,����l6>�2Ar�}d�+H:5�,C���ky�Q� t�nj��y�����Ͽ��M_�y@�#d����W���������|T��j��/Ws�`K��Q�^RWg]�_������c��1�S�ss8�'+�Z�Q�WRcf��˨��` ��+���������S�8�Π����5Z������F�Z�~Q�l�7�@W�Rp� N�Ɩז��tȻ���8`s����]�w�iE�E4�j�$j�52����hxD*T �'�gS9 %u���3�~��F�;/E��p%ӷlv��� ��l^����\HT"�@xΡw![o���.���pd�V�� r&�%��wwRD�د�,F = �uX��F�����ȥ;~}/�+Q �F0F���b��q<��ɥ���V��V�� \^��?�5ܱJ듌�|���OÉ�Z`[�̬��I; 5ad7�"�\V;3y�3 ־u�PC9c0�Oֳyi) 1�=0��c�q����δ��7��J6��m�!���0�H��P�VS���],P�pUդ�U�:�/#��F�4亀C��i���s��n����m�>�lEۑ٤B1�{[�p����ͷe,,�"3P7g��H��E6���'x��*����<�N���\����5�d<�Ő_�l��-���.��&��ʔ�#סr�7N�� �=� ��!�m�t���Pͺ�K�`�6����H/�b�0�$��=��.�E}y��S����Ǣ���T�fS���9���*�\�Y~����d�뇇;�g�x��a5�Ҳy���ƻ;���P��� ��Ѹ}�ʫ9���E�P�C��SW�����6�$|�����1�&�b�����4I���D��:�rZ+��7%]�6P�.����Ŝ�kd��f��QY���In��1�%�œc`�xph�M��/~�܅�D�fˊ� =5h����bЈh�0�Ȥ�_�x 6 SECURITY/TRUST.gz 0000644 00000004746 00000000000 0007252 0 ustar 00 � �X�o��ο��K�ie;h (hŵ[�kT2R �.�w�!�w���}o�ݓ,�@?4��μ�y�f�w.�.�So��;����6���d�wV��&��nCgu�S�iUn:<l^�r}���)��Iap�V��� n�38�uɅ!5J��Q!f3�V�M}f�h��|z�Ƥ���mo�n��ho���>X�!��� �$�N������l�p�g��\�pI=y�x�5P�Mz�9��������z�aM�ң�;3&��s0=�(1��y+�6r�3ג�� ���s7ߑ �bo���[ڇL'�fduo��0E�CD���Mcl�R�^1�v=m���.����wfO|Œ�G�yXi��6L�R�[�f���K�Z� wa��x�����$���w����࡛����s~��E���{Ɲ�nC?z�yy{3 m��s�>�$�&Ǽ�à�G�g��I?�o<�~�W�)��6�l���II���|K<f��(O����#�� �u�G&j�� �ό����;c��=�.��9-Wk7\��w֣ڔ�)P"n<��X��(S�H5�l�S�Уtܞ�ݹh�"�N�7��Z���?������^�_[�����3#��Ӈ�����K�a�7��oK�X��kcHa�]+��;���F��ëli���(4Z�<W����aUz �ډ������\��i�Y�lw�wD�� ,Ȇ�ױ x��DO���tW��=뿂S)�m0=�Q,b�"�w0�kzЅQ WL&��,�ڽh�h��(K�D/Q6���^��G�� �z�G�4��7��.K��e�ܯ��G=���e]�?�J������Ƃ�lcD�jĒ��XN���ߟe�4��,0EAۦ� L&IM�I[͖J�� }�f��,���w�#'�b����ZZM*�?FW�,�����>�~�e9e��4�X4����7Q�)� ��ػ��bS�� MfOs�xs�d����m84<wCF�>V�O�B71Lk������G���w�ݵ���y���62��5)�� JD��W�[ YK9���ij3 �vw~A;[�5s����� ��f���Q�>͞i��Nu&&������`��wb��_�Y�|?�s��.J�(5��ޅ0�4��0 X�/��'�~)�:�@#=��� �$�I7�*~���XqAϕ{��o�\�jm[C"�]�4!-SF�P-p(U�����2�I+S�\�f[��L�t�V��J�Ln m�-Y)��;�i�B��ʎ��0p�L��_'���$Q�����d��UiWR�����'�`4���8!C�N����;h��m6��<�� �*n<� q�#dh� X1i���g�!d<�il��!�#ć�$ �϶���)�7 ��EO�:��A�*]#WO�u�zԀ�A�vɽO��I�J�h����iB�^��?k��K���?��.~4)Q��@�<��,�^�Wx��>Z�B7wono1���� �� ��K �sT�^*�BӼ�g~��#&�Fz��ɤz�A�f�\~���g�q��D�y_�(�=���^��/_ݼy��f�v����_c��g���?I�����}�n�(Nep�X�+� �@��^t�i6�e��K��䮒�Y9�C5�ϲ�g���m��ƳY�n(7�� RT�_���BR�/�/�59^��W����:��THk~���i�A� W�j$ ����� ^��l!���R�Xh��Y�!뗅(� ����堕� Ƅ�rh�i���ڌ� ,��$����ڿ`�`� F�"�e�"<��a�B$x���ݶ b�xq-B�U���^���\�Ǘ��(UH�V�Mj�qSl�y��O�,F�ػ�g���M?~sV��"���Qb�O��A ���G�i�G֣��\֔��g �H�a��@���8~S�g��N4�yr�Q�aHt)9�9}��1]�^ "5�j4Vi,g\-�v�/\Y��s)�m({��к��U��S��j���bn�Trپ�#�/�*�˰]�ʛ��X���-J���Bc�x�2�qZ���kA��7����H6T���\���Ck�4y�$�9�#VݳtLX���o�U���N��4hڳ� x��c����M�!�b��jb��4WC]]eC�͔�KU0#r���Mjm�7�B7be���m�����u�y�Pb�&�n}w�^_�w�/��R�����G��/cJ�:���R��w��f�[�9wBʡ �Q5�B��"�ƞ�(umk9�O{.BIag7rf��w ��ME+�� Td�#M��A�f1E���Iz�l���uo��o��T�'�C.�0u��x�YQB�W.cE��o5Vt��� ���I4Sޑ��݄�3��A[���9��ٹ�S��]�Jf�T��y"52"x�w��1(l�h�����eMu/��,]�l�}R���%����|В':(�A#�� d� SECURITY/IMPLEMENTATION 0000644 00000004336 00000000000 0010032 0 ustar 00 This document details a few steps and decisions taken to ensure vsftpd is free of common implementation flaws. Tackling the buffer overflow ============================ Probably the most common implementation flaw causing security problems is the buffer overflow. Buffer overflows come in many shapes and sizes - overflows onto the stack, overflows off the end of dynamically malloc()'ed areas, overflows into static data areas. They range from easy to spot (where a user can put an arbitrary length string into a fixed size buffer), to very difficult to spot - buffer size miscalculations or single byte overflows. Or convoluted code where the buffer's definition and various usages are far apart. The problem is that people insist on replicating buffer size handling code and buffer size security checks many times (or, of course, they omit size checks altogther). It is little surprise, then, that sometimes errors creep in to the checks. The correct solution is to hide the buffer handling code behind an API. All buffer allocating, copying, size calculations, extending, etc. are done by a single piece of generic code. The size security checks need to be written once. You can concentrate on getting this one instance of code correct. From the client's point of view, they are no longer dealing with a buffer. The buffer is encapsulated within the buffer API. All modifications to the buffer safely go through the API. If this sounds familiar, it is because what vsftpd implements is very similar to a C++ string class. You can do OO programming in C too, you know ;-) A key point of having the buffer API in place is that it is MORE DIFFICULT to abuse the API than it is to use it properly. Try and create a buffer memory corruption or overflow scenario using just the buffer API. Unfortunately, secure string/buffer usage through a common API has not caught on much, despite the benefits it brings. Is it under publicised as a solution? Or do people have too much sentimental attachment to strcpy(), strlen(), malloc(), strcat() etc? Of notable exception, it is my understanding that at least the rather secure qmail program uses secure buffer handling, and I'd expect that to extend to all Dan Bernstein software. (Let me know of other good examples). REWARD 0000644 00000000175 00000000000 0005417 0 ustar 00 At some stage, a reward may be offered to anyone finding a serious security hole in vsftpd. Mail me if you have any ideas :) TUNING 0000644 00000002355 00000000000 0005441 0 ustar 00 So, you want vsftpd to go quickly? Here are some random assorted performance tips. 1) vsftpd thrives because of its lightweight RSS and vm usage. If you run a glibc based system (e.g. RedHat 5+), look in /etc/nsswitch.conf, and if possible, disable the "nis" and "nisplus" options for "passwd", "shadow" and "group". This prevents unneeded runtime libraries being added into the vsftpd virtual memory space. 2) vsftpd will attempt to save CPU power by using sendfile() on capable operating systems. Currently, Linux 2.2+ and FreeBSD 3.0+ use sendfile(). Consider running on these excellent operating systems. 3) Irritated by vsftpd using _two_ processes per connection? Don't be, it's a very secure architecture. However, if you run Linux 2.4+, or Linux 2.2.19+, a "one process" security model is possible thanks to nifty security features. See the vsftpd.conf man page. 4) Avoid large directories (e.g. thousands of entries) if possible. Many filesystems do not handle such cases efficiently at all. Preparing large directory listings will require vsftpd to use moderate amounts of memory and CPU. If you _must_ have large directories, consider either making them unreadable, or use a filesystem which copes well with large directories such as reiserfs. SIZE 0000644 00000000610 00000000000 0005177 0 ustar 00 I'm not sure what you expected to find in this file :-) Anyway, this is to explain that vsftpd is not as much code as you might expect from running a command like "wc -l *.c". Why? Simply because I use a very verbose style of coding in vsftpd, which consumes a lot of lines. Verbose code is very important in a secure program. How can you verify a program's security if it is not readable? BENCHMARKS 0000644 00000005534 00000000000 0006054 0 ustar 00 - See also SPEED Update 2nd Nov 2001 ftp.redhat.com ran vsftpd for the RedHat 7.2 release. vsftpd achieved 4,000 concurrent users on a single machine with 1Gb RAM. Even with this insane user count, bandwidth remained totally saturated. The user count could have been higher, but the machine ran out of processes. -- Below are some quick benchmark figures vs. wu-ftpd. This is an untuned BETA version of vsftpd (0.0.10) The executive summary is that wu-ftpd got a thorough thrashing. The most telling statistic is wu-ftpd typically failing to sustain 400 users, whereas vsftpd copes with 1000 with room to spare. A 2.2.x kernel was used. A 2.4.x kernel should make vsftpd look even better relative to wu-ftpd thanks to the sendfile() boosts in 2.4.x. A 2.4.x kernel with zerocopy should be amazing. Many thanks to Andrew Anderson <andrew@redhat.com> -- Here's some benchmarks that I did on vsftpd vs. wu-ftpd. The tests were run with "dkftpbench -hftpserver -n500 -t600 -f/pub/dkftp/<file>". The attached file are the summary output with time to reach the steady-state condition. The interesting things I noticed are: - In the raw test results, vsftpd had a much higher peak on the x10k.dat transfer run than wu-ftpd did. Wu-ftpd peaked at ~150 connections and bled down to ~130 connections, while vsftpd peaked at ~400 connections and bled down to ~160 connections. I tend to believe the peaks more than the final steady-state that dkftpbench reports, though. - For the other tests, our wu-ftpd setup was limited to 400 connections, but in about half of the x100k/x1000k runs could not even sustain 400 connections, while vsftpd handled 500 easily on those runs. - During the peak runs at x10k, the machine load with vsftpd looked like this (I don't have this data still for the wu-ftpd runs): 01:01:00 AM all 4.92 0.00 21.23 73.85 03:31:00 AM all 4.89 0.00 19.53 75.58 05:11:00 AM all 4.19 0.00 16.89 78.92 07:01:00 AM all 5.61 0.00 22.47 71.92 The steady-state loads were more in the 3-5% user, 10-15% system. For the x100/x1000 loads with vsftpd, the system load looked like this: x100k.dat: 09:01:00 AM all 2.27 0.00 9.79 87.94 x1000k.dat: 11:01:00 AM all 0.42 0.00 5.75 93.83 Not bad -- 500 concurrent users for ~7% system load. - Just for kicks I ran the x1000k test with 1000 users. At peak load: X1000k.dat with 1000 users: 04:41:00 PM all 1.23 0.00 46.59 52.18 Based on what I'm seeing, it looks like if a server had enough bandwidth, it could indeed sustain ~2000 users with the current 2 process model that's implemented in vsftpd. I did notice that dkftpbench slowed down the connection rate after 800 connections. I'm not sure if that was a dkftpbench issue, or if I ran into something other limit. README.security 0000644 00000000160 00000000000 0007230 0 ustar 00 For documentation about the security of vsftpd, please consult the files located within the SECURITY directory. TODO 0000644 00000003451 00000000000 0005200 0 ustar 00 CRITICAL ======== NOT SO CRITICAL =============== - ABOR handling broken for SSL connections (does any client actually use it?) - Add -Wconversion - Don't leak SSL private key to compromised process? May be impossible. We'll see, would be an interesting security story. - Better reporting of failed uploads due to out of device space or quota all used. - Upload file size limits. - Improve FAQ, docs (ongoing..) - Sweedish, Russian etc. characters showing as ? in the log - many complaints. - "add_group" support. - Still reports FlashFXP broken when trying to do FXP. - Add negation, other support to regex handler. - Allow groups to be listed in user lists. - Allow space in username. - Minor: background should happen after listen has completed so that failure can result in a non-zero exit code. - option to chroot to home dir and THEN apply init_dir - separate upload/download max rates - select() is assuming Linux behaviour (not threatening stability) - add example global bandwidth limiting. - have a chown_uploads for non-anon users too; also more control over permissions of uploaded file ON THE BACK BURNER ================== - MLST, MLSD - LPRT, LPSV - log logout (pam session support provides this for locals) - Limits on GIDs allowed to authenticate? - Dynamic login info e.g. you are user XXX of YYY. - Handle SIGINT. - Session byte transfer counts in STAT output. - Test vsftpd with pam_opie (issues with challenge/response vs. FTP protocol?) - SITE GROUP support. - SITE UTIME? - Allow listener to listen on multiple IPs, protocols; bonus points if the different IPs can have different configs. NOT PLANNED =========== - telnet strings (no demand) - "Minimal" build support - transparent tar / compression support (no demand) - put anon FTP users in wtmp too? - Integrated test suite (I'm so lazy..) SORRY. changelog.Debian.gz 0000644 00000002352 00000000000 0010161 0 ustar 00 � �Vio�F��_�~�՚���&Ab���$F�(��X�O���.�����[Q��V2�2��3o��je��+�8 Y��-��. ����v�38]�,6O[,�k�� ~��q����4`,WW(mPsY YB��/�^]����Av�uNk�J��\X[C��k��_^��C�Ƴ$NGtP�Y����K���5ץ�'�0�n�y�����MX���'�'��k fq l�gq�b��Ō���~��{\����[�� 7��v��h6f�drBOS�� ���#.5ϖ �xŅ4�]Þ�u%�;-**�'����l�ò��_�<�8�\x�1DI�D9�B���RO�(Y8є���UPx��n���:��4��h�$�T'$�oa�}; 3��WfQJ��Ɍba�B�턩��U�?t���~빿�-��t������[[n�m�Rݨ�7c���>v;��q%���a��Q����}��и�s.6l)\�/p���b�%a�KQ9�e�������4�Y��i6�n6_qi�T�$6��^�%��Y )l�h�6�H����>�,�݇N>'d�oAq����ˎJyo1K��e�"E�o.�n�e㞗��t���)U[�5dYNiF5��a����Zo�~�p�8wt�]c7ШJ��Pi$Vp��ܣ�7}=�� ��ٸ��@��k;�[�2 |F�=㽕���0��l-o׃��xG;�y�S&%�hG�~'���*%�G�) EZ�LqbI�-E�@(�5���Q���oJ���Jo��Ȳ8�G�H��1��X�g�B�B�Q;���A��Fpfk=%$�E�����'�I���GlՊ�sa��_ {�Z�)6� a��.(����4�@(�Z6������) �5�����h<|F�!�WӚk�F��7]@�BS�:0�� L�\SRQ7HGnZ!����V���NJ,(���ID',�Y��T~ XRr��eP�[l)�%}��Ԁ56���)�B�k�&l6�O}B����s')�g���'��8��~�g��6���R�z0s�g��9\�%Jמ����@���O!N�w�l��thf��,�]��b�`<��<���t� /j�t���ύ�Ԕ�e�.P2v��LȆ*N�e�e3a�`���r�nJnyK��=q?M�3���&�;sL?��dJz0�jTj2XS��&�� h'��zU$��=�GG���6+� README.ssl 0000644 00000004103 00000000000 0006163 0 ustar 00 As of vsftpd version 2.0.0, SSL / TLS support is provided. The SSL / TLS support provides the ability to encrypt FTP logins and subsequent commands, as well as the data transfers themselves. The encyption will, for example, stop the stealing of sensitive passwords via network snooping. By default, SSL support is disabled both at compile time and at runtime. Before considering enabling / using SSL support, there are some security considerations: - Only enable SSL if absolutely necessary. Enabling SSL will allow attackers to make use of any security problems in the OpenSSL libraries. Note that the OpenSSL libraries are a large quantity of code and have had the occasional security problem in the past. For example, your server might use virtual users to control access to non-sensitive download content. In this case, the passwords might not be worth securing with SSL. - After enabling SSL, consider restricting access to an SSL enabled server where feasible. For example, only the internal network might need access. In order to enable and use SSL support, you need the following: - vsftpd built with OpenSSL support. This is a decision your vsftpd packager made, or if you are building vsftpd yourself, edit "builddefs.h" and change the "#undef VSF_BUILD_SSL" to "#define VSF_BUILD_SSL". - "ssl_enable=YES" in your vsftpd.conf. - A SSL certificate. By default, an RSA certificate is looked for at the location /usr/share/ssl/certs/vsftpd.pem. To get an RSA certificate, either buy one from a certificate authority, or you can create your own self-signed certificate. If you have OpenSSL installed, you may find a "Makefile" in your shared certificates directory, e.g. /usr/share/ssl/certs. In that case, go to that directory and type e.g. "make vsftpd.pem". Then answer the questions you are asked. Alternatively, read the man page for "openssl". - Also be aware of the following SSL related parameters. Read the vsftpd.conf.5 manual page to learn about them: allow_anon_ssl, force_local_logins_ssl, force_local_data_ssl, ssl_sslv2, ssl_sslv3, ssl_tlsv1, rsa_cert_file, dsa_cert_file, ssl_ciphers. NEWS.Debian.gz 0000644 00000000676 00000000000 0007015 0 ustar 00 � mQ�n�0��)xl��q�yزn�ϖC��+|�N�bӶ[ (�F�`;����A����k>Tp�L�T%*;�`=�]��!P��<~�2��� n�1��h�n���g�@��֡cp�T�oo6?�������0�. ȖGv�ŧ2>��TH��Pk"�����g��pg����u2�u���Z� g/@��GP�"�X��W�O�.SY6� �6U�L�d���b���M��BX�>J�HBm:)��J��/@���ii�ݩ;��l�ð;�ܨl�9>;��6]��HfR����!#�h>�_ �\�^[�*���>ȥ� aɎ"�g %Bp�֯��Ε��N$�ŦP ��<x��V�+W�O����Ǵ� uC�%5g���po���=��w��2�������Rp'����Z-�I�A��H��� FAQ.gz 0000644 00000011743 00000000000 0005464 0 ustar 00 � �[[s�ȱ~�_1Ƌ�*�xw��O���k;V�/�J�f�kI�p[@�y�o���3�P�l'�$"���{�=ٺU��z�ٿ[��^wgs�_�/��={����R?ѿ�Z_��"��l�t��~c�No����l�7]a�uy���.�6�6��m�,͒HX���e�پ/�+�m���e��rA;���� ���f��~�k��ʢ�sz�twzW���2>�vS8���%s�Yݬ@��/{q��+�=o R/��q�鋭u3U6͝.jp�1]����n:]��|m��〉ɱH,��~�]-s�6;ۭ�R%U3Խ�ϗE�')�NoE=nhۦ�QYTE�����C���@�������9w�D��> ��5^�>�/����z[d6�W��'�Jө䞿L`�Q'g��xnm7����Wׁ�P�Ru��г�o�MՖ,rު��w���t��]2��>U�'D �ꑏZ'�7unʦ� Y���v��I�D��풱 �d�k�ۃ/l�NO^���/���W���g���l���^��i��:(��Ι5��jp��aj����m54����IRXc֦�]�sS�m���U�:���p-�'-yɩp2v�`ʒ"_�u��a���O�Ɓ�~�����i�i�2ן����]r�;��i�Ӗ�T�`����WX2r�`H�̞$�*��y7a�����B�z���n�a�*֛��M�۪�iCzu��,�f�G��"�&^'A�\�ɏ��n���6�(��Y5P`Y�Y(�@S��~czފ��_Ťd��7V=���+�����6��Z����O�hD ��;���>�0�*x���͝� NJe.�D�Mt)�Z7��-J���$>�LC�15Y6k8Q`�MA|k��̶m�+�(�����SL��iWf(�Yp��pd+��'�_��!��n�}E[ʻT_�ۚV�oS0`�Om����)I�x�K ��x8R1�bOy��!��8�/?����VR���F��п�9�Ų5֩��&s�m�� "��O�Z�#|ٝp����友�Ԯ(KM�Ӝ_8����Ja��%�@�E�!�*���������{+�Л�Cn�1�(�n��{���D�`:���˓����)P8��z�F �BWN�x�䲱�4�i�˽ y���6&G�uk�C�Α��#�������& �c^=�ء� m�4&"��\b�Ćg�u�7�]�+��L�����{�c<��n�� !�Sܐ,Ż�FѷǞ�:�!i�_�<D=��˿�ec*��lL�q��*���k��?��|v���w5�.oS������yaK��ȑj����D�<�y!��U�8K�k�� 9 k�L��(8���C��I��I���$�ڮ� Deb>*9J9�nZ��Q�s�aHV����bnlE��}����Cpv0j��P�)#��_��M���^��J�A~�7��[�P���T�Xe���'�Ϧ�6��� ߙ�@j�m+��8~�hg�-T��5^��fn�^X!b�pw�����VDARA%}ה#Z����$㙧��:�(<�!� ��8A��O%Ɋ��1 ���&���-�T���B!���K $:�-@gDw*3�K�NM��C?�3�wH#�'zgj�4 $��-�"�#���[��*��]��e � Q��z��|'9��ű쥐b1A��k��D���9���pFYS�BY��w }~��lCH��H�{|��m���_�]\� �A�Yp��ۈ5E�us�Hu�A�qg , �Z|/�͉͊��_��%�s(���3�w����c��0� Rۂ��D���W�b�����qE��]wT��R>���� E �r�#_]8�B ��ꊒB���:�X����z '6T d�9�E�-���H��Nl�-�\�1��� ���4$ˉ�1=��{_*���B���Xh⠅3�b�� z5�G�� Fa�����h��u�Q��&�/r�NP�Ld�^��K��(aH� ���*�@�}J�U�_��%iF!�/T�T0t{J�z�X�HʺM�J]�c^ߧ�o�w�\�ϓru���B� |ɦ�,�ۅyh;����ɚ�=Q�LF��<�Nm�@��z zb�R]=�"�8]P�cs�� �j�z��Y�*�zr�˄#{�A�v#E:�/�P�6_�@ �ȍ��.rr�P^s���X�E -��J�'j��*�!s p�I�,Jn���.Ia��0��*�}')�l��(9�P O�M�,���6ʷ�fr��T8�M�� R�Q������"�JQ*�0�a6� -^�#.@R ��X�H���"��M�W�Z���tǩ����`���ǁ����.��^���3s/Ͼ�� _�\B&#�_MIs�07��|�0��C,r�� xO�K��i\��V�w>�r�ɟ��n�C�1�ojH��w�gQI8�ۧ�� ;�����ٳ��:FO��K��{~ܗ#��L[p�96�P�dI��'��~���<jy�ɬFUs� S���xBx�'%F��~0�Wϔ�1q� �E��dU���#���Ʋ5�����0 ���4J,�eMS���llц����w��� �p��1���Ʈ0��'W�Q��J�ZZ��'>��Dj[T�|�z���@�ݘ�I��更��M֦��I'q�F�xH���@�Fl��{Kj��i���hT~;�Z;�A6���X����x�@��$��27-�AW{�W�%S9G��B�)�c_'x5��?f���͋>�࠲9�#�h�ľ�|�^��?d��i�y �O��M���2C�(��aJz�ȄOE�# ��m2�|��%(�9\��á� � tO2�'cD��t�D!� ��$"U��{�]]�A�ס��T����h�v��: �@�����v��@��M� 䑈o��%�MBFP����8(�I�x��2V��ix%s�<�H�R�;��O�c�$4�R��R�^�LQ�8N���� ���S�BGw^f���.�)�:ܺ5�]0���L<�,6�JP���vY �x��?��<�.}x�ُ'�����m�t�� v�C�����)���c��4��`2ʏ�꣬�{�B���א��'(�B�5"��ۓ��lLA�+(�D{E���e��� }Q����i2 ��1\)��L�;gq�Q��~v�ɳЗmJj�x�]l����� �w��L���~��$Wa(���z��� �ʄ�G|�˞AMX���x�^P]�v�q�~��?�Zz�/Zp��t������7ǹ�$�O�����x� �٠�{μ)�����LI�q|�~����E�4U�1�e�cd���tԥ`HI���Lz�,'T�`�����{�U�>