Apache HTTP Server Version 2.2
Apache HTTP Server Version 2.2
This document refers to a legacy release (2.2) of Apache httpd. The active release (2.4) is documented here. If you have not already upgraded, please follow this link for more information.
You may follow this link to go to the current version of this document.
| Description: | FTP support module for
mod_proxy |
|---|---|
| Status: | Extension |
| Module Identifier: | proxy_ftp_module |
| Source File: | mod_proxy_ftp.c |
This module requires the service of mod_proxy. It provides support for the proxying
FTP sites. Note that FTP support is currently limited to
the GET method.
Thus, in order to get the ability of handling FTP proxy requests,
mod_proxy and mod_proxy_ftp
have to be present in the server.
Do not enable proxying until you have secured your server. Open proxy servers are dangerous both to your network and to the Internet at large.
Why doesn't file type xxx
download via FTP? How can I force an FTP ASCII download of
File xxx? How can I do FTP upload? How can I access FTP files outside
of my home directory? How can I hide the FTP cleartext password
in my browser's URL line?This module provides no directives.
You probably don't have that particular file type defined as
application/octet-stream in your proxy's mime.types
configuration file. A useful line can be
application/octet-stream bin dms lha lzh exe class tgz taz
Alternatively you may prefer to default everything to binary:
DefaultType application/octet-stream
In the rare situation where you must download a specific file using the
FTP ASCII transfer method (while the default transfer is in
binary mode), you can override mod_proxy's
default by suffixing the request with ;type=a to force an
ASCII transfer. (FTP Directory listings are always executed in ASCII mode,
however.)
Currently, only GET is supported for FTP in mod_proxy. You can of course use HTTP upload (POST or PUT) through an Apache proxy.
An FTP URI is interpreted relative to the home directory of the user
who is logging in. Alas, to reach higher directory levels you cannot
use /../, as the dots are interpreted by the browser and not actually
sent to the FTP server. To address this problem, the so called Squid
%2f hack was implemented in the Apache FTP proxy; it is a
solution which is also used by other popular proxy servers like the Squid Proxy Cache. By
prepending /%2f to the path of your request, you can make
such a proxy change the FTP starting directory to / (instead
of the home directory). For example, to retrieve the file
/etc/motd, you would use the URL:
ftp://user@host/%2f/etc/motd
To log in to an FTP server by username and password, Apache uses different strategies. In absense of a user name and password in the URL altogether, Apache sends an anonymous login to the FTP server, i.e.,
user: anonymous
password: apache_proxy@
This works for all popular FTP servers which are configured for anonymous access.
For a personal login with a specific username, you can embed the user name into the URL, like in:
ftp://username@host/myfile
If the FTP server asks for a password when given this username (which
it should), then Apache will reply with a 401 (Authorization
required) response, which causes the Browser to pop up the
username/password dialog. Upon entering the password, the connection
attempt is retried, and if successful, the requested resource is
presented. The advantage of this procedure is that your browser does not
display the password in cleartext (which it would if you had used
ftp://username:password@host/myfile
in the first place).
The password which is transmitted in such a way is not encrypted on its way. It travels between your browser and the Apache proxy server in a base64-encoded cleartext string, and between the Apache proxy and the FTP server as plaintext. You should therefore think twice before accessing your FTP server via HTTP (or before accessing your personal files via FTP at all!) When using insecure channels, an eavesdropper might intercept your password on its way.