Hitchhiker's Guide to Openbsd

Starting up the server and logging
You can choose to start ftpd either by 
inetd(8)
 or from the 
rc
scripts. These examples will show our 
daemon being started from inetd.conf. First we must become familiar with some of the options to ftpd. 
The default line from /etc/inetd.conf is: 
ftp stream tcp nowait root /usr/libexec/
ftpd ftpd -US
Here ftpd is invoked with -US. This will log anonymous connections to /var/log/ftpd and concurrent 
sessions to /var/run/utmp. That will allow for these sessions to be seen via who(1). For some, you might 
want to run only an anonymous server, and disallow ftp for users. To do so you should invoke ftpd with 
the -A option. Here is a line that starts ftpd up for anonymous connections only. It also uses -ll which logs 
each connection to syslog, along with the get, retrieve, etc., ftp commands. 
ftp stream tcp nowait root /usr/libexec/
ftpd ftpd -llUSA
Note: For people using HIGH traffic ftp servers, you might not want to invoke ftpd from inetd.conf. The 
best option is to comment the ftpd line from inetd.conf and start ftpd from rc.conf.local along with the -D 
option. This will start ftpd as a daemon, and has much less overhead as starting it from inetd. Here is an 
example line to start it from rc.conf.local. 
ftpd_flags="-DllUSA" # for non-inetd use: 
ftpd_flags="-D"
This of course only works if you have ftpd taken out of /etc/inetd.conf and made inetd re-read its 
configuration file. 
It is not necessary to give additional startup options to ftpd to allow anonymous connections. The 
preceeding steps of creating the 'ftp' user and configuring the relevant directories with the correct 
permissions are enough. However, to stop anonymous connections it isn't necessary to undo everything. 
Just restart ftpd with the -n option included. Anonymous connections are then disabled.