NOTE: CentOS Enterprise Linux 5 is built from the Red Hat Enterprise Linux source code. Other than logo and name changes CentOS Enterprise Linux 5 is compatible with the equivalent Red Hat version. This document applies equally to both Red Hat and CentOS Enterprise Linux 5.
Red Hat Enterprise Linux ships with two different FTP servers:
Red Hat Content
Accelerator — A kernel-based Web server
that delivers high performance Web server and FTP
services. Since speed as its primary design goal, it has
limited functionality and runs only as an anonymous FTP
server. For more information about configuring and
administering Red Hat Content
Accelerator, consult the documentation
available online at https://www.redhat.com/docs/manuals/tux/.
vsftpd — A fast,
secure FTP daemon which is the preferred FTP server for Red
Hat Enterprise Linux. The remainder of this chapter focuses
on vsftpd.
22.2.1. vsftpd
The Very Secure FTP Daemon (vsftpd) is designed from the ground
up to be fast, stable, and, most importantly, secure. Its
ability to handle large numbers of connections efficiently and
securely is why vsftpd is
the only stand-alone FTP distributed with Red Hat Enterprise
Linux.
The security model used by vsftpd has three primary aspects:
Strong separation of privileged and
non-privileged processes — Separate
processes handle different tasks, and each of these
processes run with the minimal privileges required for the
task.
Tasks requiring elevated privileges are handled
by processes with the minimal privilege
necessary — By leveraging compatibilities
found in the libcap
library, tasks that usually require full root privileges
can be executed more safely from a less privileged process.
Most processes run in a chroot jail —
Whenever possible, processes are change-rooted to the
directory being shared; this directory is then considered a
chroot jail. For
example, if the directory /var/ftp/ is the primary shared
directory, vsftpd
reassigns /var/ftp/ to
the new root directory, known as /. This disallows any potential
malicious hacker activities for any directories not
contained below the new root directory.
Use of these security practices has the following effect on how
vsftpd deals with requests:
The parent process runs with the least privileges
required — The parent process dynamically
calculates the level of privileges it requires to minimize
the level of risk. Child processes handle direct
interaction with the FTP clients and run with as close to
no privileges as possible.
All operations requiring elevated privileges are
handled by a small parent process — Much
like the Apache HTTP Server, vsftpd launches unprivileged
child processes to handle incoming connections. This allows
the privileged, parent process to be as small as possible
and handle relatively few tasks.
All requests from unprivileged child processes
are distrusted by the parent process —
Communication with child processes are received over a
socket, and the validity of any information from child
processes is checked before being acted on.
Most interaction with FTP clients is handled by
unprivileged child processes in a chroot jail —
Because these child processes are unprivileged and only
have access to the directory being shared, any crashed
processes only allows the attacker access to the shared
files.
