new user questions. (Before I back myself into a corner!)

Polytropon freebsd at
Wed Nov 24 12:35:37 UTC 2010

Allow me to answer some of your questions without begin too
precise about the "whole picture", because I just can't speak
about all aspects due to lack of experience. :-)

On Tue, 23 Nov 2010 22:55:51 -0000, "Dave" <dave at> wrote:
> I'd like to:-
> Have a ssh login via LAN available, I believe that's a standard feature, 
> but I expressedly disabled that (well, told it not to implement it) when 
> I orignaly installed the OS. 

The SSH functionality is provided by


in /etc/rc.conf; upon reboot or

	/etc/rc.d/sshd start

the server gets activated. If no keys are present, they are
generated at first startup. You can also provide your own set
of keys if you already have some. See

	man sshd

for details.

> Have a small web server, again I've read that Apache can do a good job, 
> but I don't want (nor need) all it's facilities, in particular I need to 
> lock it down so no "Put's" can happen for a start!  The web pages are 
> simple flat form, text and static graphics, with a little client side 
> scripting, purely to find the client's local date and time, to select the 
> graphic to serve.

Well, lighttpd comes to my mind, although there are some others
that are really good at this "simple stuff". Reducing things to
a working and functional minimum isn't as easy as it sounds. :-)

> Have a FTP server, so I can automate some of the web page graphics 
> updates, from other systems that generate the data, and can FTP files 
> across the LAN, also of course for general web page maintenance needs.

The system brings an FTP server. You can enable it by uncommenting
the entry

	ftp  stream  tcp  nowait  root  /usr/libexec/ftpd  ftpd -ll

in /etc/inetd.conf. With this approach, the system's inetd controls
the communication to the server program.

You'll notice that THIS line has ftpd -ll (ell ell) instead of just
one -l. This is intended for log purposes. Add the line

	*.*	/var/log/ftpd.log

to /etc/syslog.conf and

	touch /var/log/ftpd.log

to create a log file for the FTP server. This can help you to
spot misbehaviour either on server or client side.

> That sounds in the face of things what I want, but am unsure of the 
> implications of doing that.  Is it "better" (ie, easier for a novice to 
> manage) than the native OS based FTP server tool?  I would preffer to 
> have FTP login's that are in no way related to any system login users.

In order to disallow system level accounts for FTP, use the file
/etc/ftpusers: This file contains the accounts that are NOT allowed
to make an FTP connection. Put "root" and "toor" (UID 0 accounts)
on top. Also put "ftp" there - this is the anonymous FTP user
which I think you do NOT want to work.

Also, consider using scp for file transfers, it's often much more
convenient, allthough I like

	ftp -u ftp://$(FTPUSER):$(FTPPASSWD)@$(SERVER) ${FILES}

for shoving new stuff onto the the web server with FTP server. :-)

There's nothing wrong with system's FTP in my opinion, as long as
you know what it's actually doing (and how), and you can see the
implications to consider to your particular needs and security

> Of all the stuff I've read so far in the FreeBSD handbook, and a few 
> other places, not one mention is made (that I can see so far) of how to 
> set services for alternative port numbers?

In the documentation of that services (FTP, SSH for example) you
can specify alternative ports, e. g. -p <port> for sshd which can
be set via sshd_flags= in the /etc/rc.conf file. It's always a good
idea to look through the man pages of the programs you use. The
system's program ALL do come with a good manpage - software from
ports not always provides that quality.

> Unless there is a compelling argument to, I'd prefer to stick with V8.0 
> too.

I don't see a problem with that. Unlike most other operating systems,
you can always use FreeBSD on "old-fashioned" hardware. For example,
I have a 150 MHz P1 with 128 MB here doing some simple "in-house"
server stuff - it currently runs 8.0 (and will soon receive an
update using freebsd-update, a tool that will allow you to keep
your system on a current state even if you don't want to run big
compile orgies on it).

> PS:	I run one of these....

Greetings es 73 de JO52TD ryryryry ...-.- :-)

Magdeburg, Germany
Happy FreeBSD user since 4.0
Andra moi ennepe, Mousa, ...

More information about the freebsd-questions mailing list