Protocol Support

Transfer of structured data is not supported.

Command Parameters

To allow blanks the option -b must be given on the command line. Notice that blanks at the beginning or end of the parameter are still not supported.

The `SITE' is in neither case affected by this limitation, ftp.proxy accepts always blanks in `SITE' parameters.

The option -y enables ftp.proxy to accept data connections from different remote interfaces. Try to avoid using this option, because it can cause security problems (see HISTORY for details).

Server Selection

remote-user@remote-ftp.server The password that is send to the proxy server is the password required
for logging into remote-ftp-server with the account remote-user.

In situations where the FTP client doesn't support usernames containing
an `@' the percent sign `%' might be used for that.

Access Control

The access controller receives the following variables:

PROXY_INTERFACE, PROXY_PORT

interface and port where the client is connected to the proxy.

PROXY_CLIENT, PROXY_CLIENTNAME

IP number an name of the connected client.

PROXY_SERVER, PROXY_SERVERPORT, PROXY_SERVERNAME

IP number, port and name of the FTP server the client wants to contact.

PROXY_SERVERLOGIN

the supplied username for the FTP server.

PROXY_USERNAME, PROXY_PASSWD

supplied username and password for usage of the proxy server.

The values for PROXY_USERNAME and PROXY_PASSWD are taken from the supplied remote username and password if they contain a colon `:'. In this case the local authentication data is taken from the left side of the colon and the remaining right side is passed on to the server.

Furthermore the acp's stdout is connected to the FTP client and it's stderr is read by ftp.proxy which writes the acp's stderr output to syslog.

Notice also that a non-zero acp exit code signals ftp.proxy that something's wrong and that ftp.proxy should terminate.

Connection Translation

variable [<whitespace>]= [<whitespace>] value where variable is one of

SERVERNAME, SERVERLOGIN, SERVERPASSWD, SERVERPORT 

and value the corresponding value.
Alternativly to these four variables you can use the shorter forms

SERVER, LOGIN, PASSWD, PORT 

as variable names.
Furthermore the case of the variable names doesn't matter and any whitespace
around value is ignored.

The ctp can deny the proxy request by exiting with an non-zero exit code,
In which case ftp.proxy drops the connection immediately.
Alternativly the ctp can also print a line starting with -ERR,
which is written to syslog before the connection is closed.

Command Control

The ccp returns an exit code of 0 to grant and any other to deny access (the exit code to the `QUIT' command is ignored). For the ccp the same variables as for acp's are set with the addition of

PROXY_COMMAND, PROXY_PARAMETER

FTP command and parameter (if set).

PROXY_SESSION

a unique identifier for the proxy session.

PROXY_CCPCOLL,

the client's number of collisions with the ccp's permission rules (number of `permission denied' responses).

The ccp's stdout and stderr are connected to ftp.proxy. A one line message written to stdout by the ccp goes to syslog, while a message one stderr is sent to the client. If this message does not contain a status ftp.proxy substitutes a `553' code. If the message is empty the client gets a simle `553 permission denied'. Notice that the stderr message is only used if the ccp returns an exit code other the zero.

On normal program termination (`QUIT' command or timeout) the ccp is called with the command `+EXIT' to do some final clean up. It is not reliable that the ccp receives the `+EXIT' event. There are lots of possiblities that the proxy terminates without generating it, e.g. client timeout, server error or signal reciption by the proxy.

Monitor Mode

is converted into an absolute path. This value is then used in syslog messages and given to a ccp in the PROXY_FTPPATH variable. Furthermore the variable PROXY_FTPHOME contains the user's initial directory which is assumed to be his home directory.

The `LIST' and `NLIST' command may have a parameter or not. If it is absent ftp.proxy sets the parameter to `*' but this affects only the PROXY_FTPPATH variable, not the command that is sent to the server.

For the `CDUP' command PROXY_FTPPATH contains the full path of the target directory.

Monitoring may not work with all server systems since the output of the `PWD' command which is used by ftp.proxy to get the current directory in not completely defined. If the directory can not be clearly determined ftp.proxy will terminate.

Interface specific configurations

[interface-ip]

followed by the configuration options for connections on this specific interface. ftp.proxy checks for such sections immidiately after the client connection is accepted. If it finds at least one interface specific section in the configuration file but none for the current interface it considers itself to be not configured for it and drops the connection sending a `421 not available' message to the client.

ftp.proxy accepts all global configuration options from above (allthough not all make sense, e.g. bind) in interface specific section. That is, ftp.proxy can have completely different configurations on different interfaces. But to deactivate a non-boolean option, e.g. ctp you can not simply give the option without a value, this would be considered as `bad configuration option'. Instead you must supply a single dash `-' to clear an option.

Configuration checking

The -F option sets the configuration file and the `check-and-print' option, that is ftp.proxy will only read, check and print it's configuration options as they are set after reading the configuration. An interface IP-number may be given as optional command line parameter to make ftp.proxy print the configuration for this particular interface.