BFTP(1)

NAME
bftp - Brimstone proxy ftp

SYNOPSIS
bftp [ -sdS ] [ -p <port> ] [ -f <configfile> ]

DESCRIPTION
bftp is the program which is invoked by inetd on the firewall to handle requests coming in on the FTP service. The user is forced to authenticate himself, and then is put into the bftp command mode.

OPTIONS

-d  turn on debugging. Aside from logging DEBUG level syslogs, there is no guarentee that this will do anything interesting, especially for non-developers.

-s  enable standard input mode. Prevent the program from exiting when it discovers (via getpeername(2) ) that stdio is not connected to a network. Used exclusively for testing, especially with a debugger.

-S  enable standalone mode, to use bftp outside of inetd. This option is deprecated.

-p <port>
    When in standalone mode, use this port instead of the default (21). This option is deprecated.

-f <configfile>
    Use this client configuration file instead of the default /etc/bs.client.conf or instead of the one in the environmental variable BS_CLIENT_CONF

AUTHENTICATION MODE
The first thing a user must do is authenticate himself, using the FTP protocol. We briefly outline the available options in the authentication phase of the bftp server.

USER <username>
    select the name which the firewall will use to authenticate th user.

PASS <response>
    Enter the first response to the challenge the firewall printed with 331 response code in reply to the USER command.

ACCT <response>
    Enter the second response (if necessary) to the secondary challenge the firewall printed with the 332 response code in reply to the PASS or ACCT commands.

COMMAND MODE
After authenticating himself, a user can run any number of commands, the most useful of which is the USER command (used in a different sense from the AUTHENTICATE MODE above).

USER <remuser@remhost.dom.ain>
    Attempt to complete the FTP connection by logging into the host remhost.dom.ain as user remuser. If you are administratively allowed to make the connect, remhost.dom.ain is reachable and is running an FTP server, and if it likes you, you will be connected to the remote server and most all future commands will be interpreted by the remote server (see below for RELAY MODE for more information).

HELP
    Print some possibly useful message from the client configuration file.

QUIT
    Exit

NOOP
    Do nothing.

RELAY MODE
When connected to the remote host, the bftp program still is watching the FTP control connection because the commands which set up OOB data connections ( PORT and PASV ) must be looked for, intercepted, and changed because of the presence of the firewall. When those command appear, they will be changed, bftp will fork(), the the child will relay data coming over the second data connection.

ENVIRONMENTAL VARIABLES
BFTP understands the following environmental variables.

BS_CLIENT_CONF location of configuration file containing configuration variables as described below.

BS_ACL_CONF location of Brimstone Access Control List (local mode only) which contains the defintions and restrictions on users.

BS_RMNT_CONF location of the client/server configuration file (client/server mode only).

FILES
/etc/bs.client.conf client configuration file.

/etc/bs.acl.conf Brimstone Access Control List.

/etc/bs.rmnt.conf Client/Server configuration file

CONFIGURATION VARIABLES
BFTP accepts many configuration values, all of which are specified the the client configuration file.
+--------------------------------------------------------------------+
| Variable              | Type    | Description                      |
|   Default             |         |                                  |
+-----------------------+---------+----------------------------------+
| FTP_CMDTIMEOUT        | number  | Number of seconds user can remain|
|   600                 |         | idle while in command mode.      |
+-----------------------+---------+----------------------------------+
| FTP_AUTHTIMEOUT       | number  | Number of seconds user has to    |
|   90                  |         | authenticate himself             |
+-----------------------+---------+----------------------------------+
| FTP_PORTOK            | string  | PORT command succeeded           |
|   PORT command        |         |                                  |
|   successful          |         |                                  |
+-----------------------+---------+----------------------------------+
| FTP_INVALID           | string  | Error message: error during user |
|   Invalid entry       |         | entry                            |
+-----------------------+---------+----------------------------------+
| FTP_SERVFAIL          | string  | General system error message     |
|   Service unavailable |         |                                  |
+-----------------------+---------+----------------------------------+
| FTP_UNKHOST           | string  | Error message: host name unknown |
|   Host unknown.       |         |                                  |
+-----------------------+---------+----------------------------------+
| FTP_CONNFAIL          | string  | Error message: connection to     |
|   Connection failed   |         | remote host failed               |
+-----------------------+---------+----------------------------------+
| FTP_BADINPUT          | string  | Generic syntax error message     |
|   Syntax error or     |         |                                  |
|   command not under-  |         |                                  |
|   stood               |         |                                  |
+-----------------------+---------+----------------------------------+
| FTP_CONNTIMEOUT       | number  | Number of seconds will wait for  |
|   15                  |         | remote machine to respond before |
|                       |         | failing/trying other IP addresses|
+-----------------------+---------+----------------------------------+
| FTP_FAKE_USER         | boolean | If defined, will print fake      |
|   None                |         | ftp-like login line              |
+-----------------------+---------+----------------------------------+
| FTP_GREET             | stringn | Multi-line greeting message      |
|   None                |         | printed BEFORE user authenticates|
|                       |         | himself.                         |
+-----------------------+---------+----------------------------------+
| FTP_FAIL              | stringn | Multi-line message printed if    |
|   None                |         | user did not successfully        |
|                       |         | authenticate himself.            |
+-----------------------+---------+----------------------------------+
| FTP_WELCOME           | stringn | Multi-line message printed if    |
|   None                |         | user  successfully authenticated |
|                       |         | himself.                         |
+-----------------------+---------+----------------------------------+
| FTP_CONNECT_REMOTE    | stringn | Multi-line message printed if    |
|   None                |         | user connected to a remote host  |
+-----------------------+---------+----------------------------------+
| FTP_CONNECT_FAIL      | stringn | Multi-line message printed if    |
|   None                |         | user FAILED to connect to a      |
|                       |         | remote host.                     |
+-----------------------+---------+----------------------------------+
| FTP_NOOP              | stringn | Multi-line message saying        |
|   None                |         | nothing                          |
+-----------------------+---------+----------------------------------+
| FTP_HELP              | stringn | Multi-line message printed if    |
|   None                |         | user requests help               |
+-----------------------+---------+----------------------------------+

SEE ALSO
ftp(1) bs.client.conf(5), bs.acl.conf(5), bs.rmnt.conf(5), sos_config(5),

BUGS
Remote does not have a n in it.

Most (all?) FTP clients appear to be restricted to two responses to a given USER command ( PASS and ACCT ). Any authentication state engine requiring more may get into trouble.