Red Hat Enterprise Linux ships with two different FTP servers:
Red Hat Content Accelerator — A
kernel-based Web server that delivers high performance Web server
and FTP services. Since speed as its primary design goal, it has
limited functionality and runs only as an anonymous FTP server. For
more information about configuring and administering
Red Hat Content Accelerator, consult the
documentation available online at https://www.redhat.com/docs/manuals/tux/.
vsftpd — A fast, secure FTP daemon
which is the preferred FTP server for Red Hat Enterprise Linux. The remainder of this
chapter focuses on vsftpd.
The Very Secure FTP Daemon (vsftpd) is designed
from the ground up to be fast, stable, and, most importantly,
secure. Its ability to handle large numbers of connections efficiently
and securely is why vsftpd is the only stand-alone
FTP distributed with Red Hat Enterprise Linux.
The security model used by vsftpd has three primary aspects:
Strong separation of privileged and non-privileged
processes — Separate processes handle different
tasks, and each of these processes run with the minimal
privileges required for the task.
Tasks requiring elevated privileges are handled by
processes with the minimal privilege necessary
— By leveraging compatibilities found in the
libcap library, tasks that usually require
full root privileges can be executed more safely from a less
privileged process.
Most processes run in a chroot
jail — Whenever possible, processes are
change-rooted to the directory being shared; this directory is
then considered a chroot jail. For example,
if the directory /var/ftp/ is the primary
shared directory, vsftpd reassigns
/var/ftp/ to the new root directory, known as
/. This disallows any potential malicious
hacker activities for any directories not contained below the
new root directory.
Use of these security practices has the following effect on how
vsftpd deals with requests:
The parent process runs with the least privileges
required — The parent process dynamically
calculates the level of privileges it requires to minimize the
level of risk. Child processes handle direct interaction with
the FTP clients and run with as close to no privileges as
possible.
All operations requiring elevated privileges are
handled by a small parent process — Much like
the Apache HTTP Server, vsftpd launches unprivileged child
processes to handle incoming connections. This allows the
privileged, parent process to be as small as possible and handle
relatively few tasks.
All requests from unprivileged child processes are
distrusted by the parent process — Communication
with child processes are received over a socket, and the validity
of any information from child processes is checked before being
acted on.
Most interaction with FTP clients is handled by
unprivileged child processes in a chroot
jail — Because these child processes are
unprivileged and only have access to the directory being shared,
any crashed processes only allows the attacker access to the
shared files.
