Administrasi dan Manajemen Jaringan 2. File Transfer Protocol (FTP)

Transcription

1 Administrasi dan Manajemen Jaringan 2. File Transfer Protocol (FTP) M. Udin Harun Al Rasyid, Ph.D Lab Jaringan Komputer (C-307)

2 Table of Contents The objectives of FTP Communication and data transfer List of FTP server return codes Active and Passive Mode File Structures Anonymous FTP FTP Commands Connecting To A Server vsftpd - FTP Server Installation Network File System (NFS) M. Udin Harun Al Rasyid 2

3 The objectives of FTP To promote sharing of files (computer programs and/or data). To encourage indirect or implicit (via programs) use of remote computers. To shield a user from variations in file storage systems among hosts, To transfer data reliably and efficiently. M. Udin Harun Al Rasyid 3

4 File Transfer Protocol (FTP) File Transfer Protocol (FTP) is a standard network protocol used to transfer files from one host or to another host, for uploading and downloading files between computers over a TCP-based network, such as the Internet. FTP is built on a client-server architecture and uses separate control and data connections between the client and the server. FTP users may authenticate themselves using a clear-text sign-in protocol, normally in the form of a username and password, but can connect anonymously if the server is configured to allow it. M. Udin Harun Al Rasyid 4

5 For secure transmission that hides (encrypts) the username and password, and encrypts the content, FTP is often secured with SSL/TLS ("FTPS"). SSH File Transfer Protocol ("SFTP") is sometimes also used instead. The first FTP client applications were command-line applications developed before operating systems had graphical user interfaces, and are still shipped with most Windows, Unix, and Linux operating systems. Dozens of FTP clients and automation utilities have since been developed for desktops, servers, mobile devices, and hardware, and FTP has been incorporated into hundreds of productivity applications, such as web page editors. M. Udin Harun Al Rasyid 5

6 The server component is called an FTP daemon. It continuously listens for FTP requests from remote clients. When a request is received, it manages the login and sets up the connection. M. Udin Harun Al Rasyid 6

7 Access to an FTP server can be managed in two ways: Anonymous Authenticated In the Anonymous mode, remote clients can access the FTP server by using the default user account called "anonymous" or "ftp" and sending an address as the password. In the Authenticated mode a user must have an account and a password. User access to the FTP server directories and files is dependent on the permissions defined for the account used at login. As a general rule, the FTP daemon will hide the root directory of the FTP server and change it to the FTP Home directory. This hides the rest of the file system from remote sessions. M. Udin Harun Al Rasyid 7

8 FTP operates on the application layer of the OSI model, and is used to transfer files using TCP/IP. Connections: control connection: The client computer is able to communicate with the server on port 21, remains open for the duration of the session. The control connection is used for session administration, for example commands, identification and passwords exchanged between the client and the server using a telnet-like protocol data connection: can either be opened by the server from its port 20 to a negotiated client port (active mode), or by the client from an arbitrary port to a negotiated server port (passive mode) as required to transfer file data. M. Udin Harun Al Rasyid 8

9 Communication and data transfer The protocol is specified in RFC 959 The server responds over the control connection with three-digit status codes in ASCII with an optional text message. FTP server return codes always have three digits, and each digit has a special meaning. The first digit denotes whether the response is good, bad or incomplete. M. Udin Harun Al Rasyid 9

10 List of FTP server return codes Each command generates a server response 3 digit code, text, <crlf> use 3 digit code as driver for GUI Clients or programatic implementations use text for Command line clients M. Udin Harun Al Rasyid 10

11 The first digit denotes whether the response is good, bad or incomplete: 1yz - Positive preliminary reply - command is being acted upon; expect a final reply code before sending another command 2yz - Positive completion reply - command was successfully executed; new command may be sent 3yz - Positive intermediate reply - command was accepted, but the final result is being delayed because other information needs to be supplied from the client; reply is used for sequencing command groups 4yz - Transient negative completion reply - command failed, but the condition is temporary 5yz - Permanent negative completion reply - command failed and will always fail if given again; the command should not be attempted again M. Udin Harun Al Rasyid 11

12 The second digit is a grouping digit and encodes the following information: x0z - Refers to command syntax x1z - Indicates information returned by commands requesting information such as status or help x2z - Refers to the state of the control or data connections x3z - The reply is associated with the login process and accounting procedures x4z - Reserved for future use x5z - Refers to the state of the requested file transfer or other file system command M. Udin Harun Al Rasyid 12

13 Example: 125 : Data connection already open; transfer starting. 150 : File status okay; about to open data connection. 200 : Command okay. 220: Service ready for new user. 430 : Invalid username or password. 425 : Can't open data connection. M. Udin Harun Al Rasyid 13

14 Active and Passive Mode In active mode, the client creates a TCP control connection to the server and sends the server the client's IP address and an arbitrary client port number. Then waits until the server initiates the data connection over TCP to that client IP address and client port number. In situations where the client is behind a firewall and unable to accept incoming TCP connections, passive mode may be used. In this mode, the client uses the control connection to send a PASV command to the server and then receives a server IP address and server port number from the server,which the client then uses to open a data connection from an arbitrary client port to the server IP address and server port number received M. Udin Harun Al Rasyid 14

15 File Structures Operating System store files in different structures FTP defined file structures for transporting files File F Unstructured, sequence of bytes Record R Series of records Page P Series of data blocks (pages) Default file structure is File (F) File Structure specified using STRU command M. Udin Harun Al Rasyid 15

16 Login FTP login utilizes a normal usernames and password scheme for granting access. The username is sent to the server using the USER command, and the password is sent using the PASS command. If the information provided by the client is accepted by the server, the server will send a greeting to the client and the session will commence. If the server supports it, users may log in without providing login credentials, but the server may authorize only limited access for such sessions. M. Udin Harun Al Rasyid 16

17 Anonymous FTP A host that provides an FTP service may provide anonymous FTP access. Users typically log into the service with an 'anonymous' (lower-case and case-sensitive in some FTP servers) account when prompted for user name. Many FTP hosts whose purpose is to provide software updates will provide anonymous logins. M. Udin Harun Al Rasyid 17

18 FTP Commands USER R User name, userid for access control PASS O Password for access control ACCT O Account info CWD O Change working directory CDUP O Change to parent directory SMNT O Structure mount, mount a different file system QUIT R informs server that client wants out REIN O restarts session at authentication phase PORT R Host addr and data port to use M. Udin Harun Al Rasyid 18

19 PASV O Passive; informs server that client will contact to set up data connections, ask server to sent port info TYPE R Data type, type of subsequent transfers STRU R File structure MODE R Transfer mode RETR R Retrieve, download the file from server STOR R Store, upload the specified to server STOU O Store unique, same as store but server picks unique file name M. Udin Harun Al Rasyid 19

20 APPE O Append, upload file to server, if file name exists, append the upload ALLO O Allocate, sometimes used to preallocate space REST O Restart, restart an interrupted transfer RNFR O Rename file from filename RNTO O Rename file to ABOR O Abort, ask server to abort last command DELE O Delete specified file RMD O Remove directory MKD O Make directory M. Udin Harun Al Rasyid 20

21 PWD O Print working directory LISTO Request directory listing NLST O Request just a file name list SITE O Site parameters, allow client to specify site specific options and parameters SYST O request server operating system STAT O Request server to send status of current xfr HELP O general and command specific NOOP R ask server to send a positive reply M. Udin Harun Al Rasyid 21

22 Connecting To A Server M. Udin Harun Al Rasyid 22

23 vsftpd - FTP Server Installation vsftpd is an FTP daemon available in Ubuntu. It is easy to install, set up, and maintain. To install vsftpd you can run the following command: sudo apt-get install vsftpd M. Udin Harun Al Rasyid 23

24 vsftpd - FTP Server Configuration You can edit the vsftpd configuration file, /etc/vsftpd.conf, to change the default settings. By default only anonymous FTP is allowed. If you wish to disable this option, you should change the following line: anonymous_enable=yes to anonymous_enable=no By default, local system users are not allowed to login to FTP server. To change this setting, you should uncomment the following line: #local_enable=yes By default, users are allowed to download files from FTP server. They are not allowed to upload files to FTP server. To change this setting, you should uncomment the following line: #write_enable=yes M. Udin Harun Al Rasyid 24

25 the anonymous users are not allowed to upload files to FTP server. To change this setting, you should uncomment the following line: #anon_upload_enable=yes Once you configure vsftpd you can start the daemon. You can run following command to run the vsftpd daemon: sudo /etc/init.d/vsftpd start M. Udin Harun Al Rasyid 25

26 Network File System (NFS) NFS allows a system to share directories and files with others over a network. By using NFS, users and programs can access files on remote systems almost as if they were local files. Some of the most notable benefits that NFS can provide are: Local workstations use less disk space because commonly used data can be stored on a single machine and still remain accessible to others over the network. There is no need for users to have separate home directories on every network machine. Home directories could be set up on the NFS server and made available throughout the network. Storage devices such as floppy disks, CDROM drives, and USB Thumb drives can be used by other machines on the network. This may reduce the number of removable media drives throughout the network. M. Udin Harun Al Rasyid 26

27 Installation At a terminal prompt enter the following command to install the NFS Server: sudo apt-get install nfs-kernel-server Configuration You can configure the directories to be exported by adding them to the /etc/exports file. For example: /ubuntu *(ro,sync,no_root_squash) /home *(rw,sync,no_root_squash) You can replace * with one of the hostname formats. Make the hostname declaration as specific as possible so unwanted systems cannot access the NFS mount. To start the NFS server, you can run the following command at a terminal prompt: sudo /etc/init.d/nfs-kernel-server start M. Udin Harun Al Rasyid 27

28 An entry in /etc/exports will typically look like this: directory machine1(option11,option12) machine2(option21,option22) directory the directory that you want to share. It may be an entire volume though it need not be. If you share a directory, then all directories under it within the same file system will be shared as well. machine1 and machine2 client machines that will have access to the directory. The machines may be listed by their DNS address or their IP address (e.g., machine.company.com or ). Using IP addresses is more reliable and more secure. M. Udin Harun Al Rasyid 28

29 optionxx ro: The directory is shared read only; the client machine will not be able to write it. This is the default. rw: The client machine will have read and write access to the directory. no_root_squash: By default, any file request made by user root on the client machine is treated as if it is made by user nobody on the server. If no_root_squash is selected, then root on the client machine will have the same level of access to the files on the system as root on the server. no_subtree_check: If only part of a volume is exported, a routine called subtree checking verifies that a file that is requested from the client is in the appropriate part of the volume. If the entire volume is exported, disabling this check will speed up transfers. sync: By default, all but the most recent version (version 1.11) of the exportfs command will use async behavior, telling a client machine that a file write is complete - that is, has been written to stable storage - when NFS has finished handing the write over to the filesystem. This behavior may cause data corruption if the server reboots, and the sync option prevents this. M. Udin Harun Al Rasyid 29

30 Suppose we have two client machines, slave1 and slave2, that have IP addresses and , respectively. We wish to share our software binaries and home directories with these machines. A typical setup for /etc/exports might look like this: /usr/local (ro) (ro) /home (rw) (rw) Here we are sharing /usr/local read-only to slave1 and slave2, because it probably contains our software and there may not be benefits to allowing slave1 and slave2 to write to it that outweigh security concerns. home directories need to be exported read-write if users are to save their work on them. M. Udin Harun Al Rasyid 30

31 If you have a large installation, you may find that you have a bunch of computers all on the same local network that require access to your server. There are a few ways of simplifying references to large numbers of machines. you can give access to a range of machines at once by specifying a network and a netmask. For example, if you wanted to allow access to all the machines with IP addresses between and then you could have the entries: /usr/local / (ro) /home / (rw) M. Udin Harun Al Rasyid 31

32 NFS Client Configuration Use the mount command to mount a shared NFS directory from another machine, by typing a command line similar to the following at a terminal prompt: sudo mount example.hostname.com:/ubuntu /local/ubuntu M. Udin Harun Al Rasyid 32

33 An alternate way to mount an NFS share from another machine is to add a line to the /etc/fstab file. The line must state the hostname of the NFS server, the directory on the server being exported, and the directory on the local machine where the NFS share is to be mounted. The general syntax for the line in /etc/fstab file is as follows: example.hostname.com:/ubuntu /local/ubuntu nfs rsize=8192,wsize=8192,timeo=14,intr If you have trouble mounting an NFS share, make sure the nfscommon package is installed on your client. To install nfs-common enter the following command at the terminal prompt: sudo apt-get install nfs-common M. Udin Harun Al Rasyid 33

34 References - Credit Dick Steflik, "File Transfer Protocol". M. Udin Harun Al Rasyid 34

35 Finish M. Udin Harun Al Rasyid 35