2.2. Directives reference

backend (default: plaintext)

The backend to use for authentication and user/group management. You can specify a test on the backend version if needed. See the glossary for explanation on what a backend is.

backend = /path/to/libwzdplaintext.so
backend = /path/to/libwzdplaintext.so > 122

In these two examples, backend will be called 'plaintext'

You need at least one backend.

backend_param_... Deprecated since 0.6.0 !

If backend needs an argument, specify it here. The argument depend on the backend used, see backend definition for details.

backend_param_plaintext = /path/to/users

This line must come after the definition of the backend.

Since 0.6.0, parameters are defined in sections with the same name as the backend. For ex, if you use the "plaintext" backend:

[plaintext]
param = /path/to/users
cscript Deprecated since 0.6.0 !

Custom scripts (or binaries) to be executed before/after certain commands.

cscript = /path/to/exe
cscript = tcl:/path/to/script

Since 0.6.0, events are defined in the "events" section. Syntax is customname = EVENT action arguments

[events]
event1 = LOGIN /bin/echo hello %usertag
event2 = SITE /path/to/event_site.sh
data_buffer_length (default: 16384) (ADVANCED, > 0.3.3)

Change the size of the internal buffer used for data transfers.

data_buffer_length = 65536

Use this option carefully ! This can havea big impact on transfer rates.

deny_files_uploaded (default: 0)

Specify 1 here to deny access to files during their upload.

deny_access_files_uploaded = 1

dir_message

When changing current directory, the server will look for this file, and if present will append it to the end of the ftp reply.

dir_message = .message

disable_ident (default: no)

Completely disable all ident lookups when a client connects.

disable_ident = yes

disable_tls (default: no)

Completely disable TLS/SSL support (even if compiled in).

disable_tls = yes

dynamic_ip (default: 0)

If you specify 1 or an ip, the server will try to detect ip changes (e.g ADSL disconnections).

dynamic_ip = 1
dynamic_ip = xxx.myftp.org

0 means the option is deactivated, 1 the server will ask the system to find its ip, otherwise the server will perform DNS lookups

hide_dotted_files (default: 0)

Specify 1 here to hide files beginning with a dot ('.')

hide_dotted_files = 1

ip (default: *) Deprecated since 0.6.0 !

Specify server ip, to restrict server to a specific interface (usefull mainly for server with multiples interfaces).

ip = *
ip = 127.0.0.1

Since 0.6.0, this command is superseeded by the port directive.

log_channel_... (default: use logfile or syslog)

Change log file associated to a specific channel. The first 10 channels are reserved for standard log levels (from debug messages to critical errors), others can be used by backends or modules. To know the level associated to a module please consult the corresponding docs.

log_channel_21 = /var/log/wzdftpd/plaintext.log

To disable a channel, just leave empty the file name field:

log_channel_21 =

logdir (default: do not use log directory)

Location of a directory where the server will put various log files.

logdir = /var/log/wzdftpd

logfile (default: do not use log file)

Log file for server activity (see use_syslog)

logfile = /path/to/wzd.log

loglevel (default: normal)

Controls the verbosity of the server in the log file.

loglevel = high

This means only messages important or critical error messages will be logged (and as this is higher than 'normal', many normal messages will be ignored). To the contrary, if you set loglevel to 'lowest', you will get ALL messages (even debug).

level can be one of (in order): lowest, flood, info, normal, high, critical

See also: Log Channels for more details.

max_dl_speed (default: 0)

Maximum cumulated (for all users connected) download speed in bytes/sec.

max_dl_speed = 300000

max_threads (default: 32)

The hard limit for child threads (clients connected simultaneously).

max_threads = 50

max_ul_speed (default: 0)

Maximum cumulated (for all users connected) upload speed in bytes/sec.

max_ul_speed = 300000

pasv_high_range (default: 65536)

The higher bound of ip range the server can take.

pasv_high_range = 3000

pasv_ip (default: *)

Specify passive ip.

pasv_ip = 64.xxx.xxx.xxx

pasv_low_range (default: 1025)

The lower bound of ip range the server can take.

pasv_low_range = 2500

pid_file (default: /var/run/wzdftpd.pid)

File where pid of server will be stored. This is used by init.d scripts to send signals to server.

pid_file = /path/to/wzdftpd.pid

port (default: 21) Changed in 0.6.0 !

The port to listen.

port = 1321

IMPORTANT: under linux, you need privileges to bind to a system port ( < 1024 )

Since 0.6.0, this option controls the port AND the ip to bind to. If you specify

port = 1321
, the server will bind to all interfaces on port 1321, and in IPv6 if available

To bind to a specific ip address, just use the ip:port syntax:

ip = 127.0.0.1:1321
The server will understand IPv6 addresses:
ip = ::1:1321

This option is multi-valued, so if you want to bind to several ip/ports, just use commas to separate the values:

ip = 1321, 192.168.0.100:1234
The server will listen on all specified addresses and ports.

reject_unknown_users (default: 1)

This options defines the behaviour of the server if the user is not accepted. The default (1) will immediatly reject user and close connection, while setting 0 will cause the server to continue the login process (sending a password request) and reject user after.

reject_unknown_users = 0

This option can be used for more security, to prevent a client from detecting user names.

server_gid (default: none)

Change the group ID of the server after binding port. This is usefull only if server is runned by root

server_gid = users

server_uid (default: none)

[Linux] Server will drop privileges and change its uid to server_uid after binding port. This is usefull only if server is runned by root

server_uid = toto

IMPORTANT: under linux, you need privileges to bind to a system port ( < 1024 )

site_cmd Deprecated since 0.6.0 !

Custom site commands.

site_cmd = my_free /path/to/free.sh
site_cmd = my_tcl tcl:/path/to/script

This will define a new site command, "my_free".

You can also print out the content of a file (parsing all cookies inside).

site_cmd = onel !/path/to/onel.txt

The default permission is to allow ALL users to run command. Do not forget to add a permission line if your command needs to be restricted !

Since 0.6.0, custom scripts are defined in the "custom_commands" section. (Ultimately, this will allow to define general custom commands, not only site commands. Syntax is commandname = action

[custom_commands]
site_myls = /path/to/myls.sh
site_rules = !/path/to/rules.txt

If the first character of the command is !, then the command with return to the client the content of the specified file (replacing cookies).

use_syslog (default: 1, except for cygwin)

Use syslog to log server messages (see logfile)

use_syslog = 1

tls_certificate [TLS only]

The name of the TLS certificate to use.

tls_certificate = /path/to/wzd.pem

tls_certificate_key [TLS only] ( wzdftpd >= 0.5 )

The name of the TLS certificate key file to use.

tls_certificate_key = /path/to/wzd_key.pem

If not specified, the server will try to use the certificate for the key file.

tls_cipher_list (default: ALL) [TLS only]

The cipher list server will negotiate during TLS handshake

tls_cipher_list = ALL

You should not use this option, or let "ALL", unless you know what you are doing.

see openssl ciphers, man openssl(1)

tls_mode (default: explicit) [TLS only]

Use implicit, explicit or explicit_strict mode (see tls modes for details)

tls_mode = explicit

umask (default: 775)

This is the permissions that are set when a new directory is created. Permissions are written in octal with the default format (permissions for owner, group, others).

umask = 755

The default permissions (775) allow every user from the same group to write files in the directory.

Remember that DELETE permission is managed in a different way - unlike unix, it's not because you have the write permission that you can delete files in it. In fact, unless you specify an explicit permission on config file, only the owner of a file (and siteop) can delete a file.

xferlog (default: do not log)

Log transferred files in common xferlog format (suitable for analysis with classical tools).

xferlog = /path/to/xferlog