v1.0.0

FTPD 1.0.0 is the first release of the standalone FTP server for MVS 3.8j. It
installs through SMP 4 — the SMP that ships with MVS 3.8j, not SMP/E — so
the system keeps a record of what is installed, and there is a defined way back
out again.

Installing

Download ftpd-1.0.0-dist.zip (or .tar.gz). It contains everything you
need and a step-by-step guide:

README.md	the installation guide
ftpd-1.0.0-load.xmit	the FTPD load module
ftpd-1.0.0-samplib.xmit	the STC procedure and the configuration pattern
ftpd-1.0.0-alloc.jcl	allocate the datasets — run once
ftpd-1.0.0-inst.jcl	receive, apply, accept

Upload the two XMITs in binary, submit the allocation job once, then the
install job — the only thing to edit is the two dataset names you uploaded to.
The SYSMOD travels inline in the job, so there is no third file to transfer.

Everything lands under FTPD.V1R0M0.*. Copying the procedure and the
configuration pattern into your PROCLIB and PARMLIB stays a manual step, by
design: the product owns the patterns, your system owns the copies, and an
update that silently replaced a running procedure would be worse than one that
leaves it alone. The guide says which member goes where.

Two things in the shipped material are not ready to run as they are:

• On TK5, SYS2.PARMLIB does not exist — put FTPDPRM0 in SYS1.PARMLIB
  and start with /S FTPD,D='SYS1.PARMLIB'.
• The two JES DDs in the procedure, HASPCKPT and HASPACE1, carry the unit
  and volume of the system FTPD was built on. Point them at your own JES2
  checkpoint and spool, or delete both if you do not want the JES interface.
  Both are required together: with HASPACE1 missing, every JES command
  answers 451.

FMID is TFTP100.

Correction — removing FTPD again

The README.md inside the archive is wrong about this, and it cannot be
fixed in a file already downloaded. It says to remove FTPD with RESTORE
followed by REJECT. Measured after this release went out: neither works.
The install job accepts the FMID in the same run as the APPLY, and an accepted
function SYSMOD refuses RESTORE because it was accepted, then refuses
REJECT because accepting removed the control statements REJECT works from.

A UCLIN job does work. The procedure, with the job and the messages to check,
is at
doc/uninstall.md.

Nothing about installing is affected — only taking it off again.

What FTPD reaches

Three namespaces, selected per session, on port 2121 by default:

• MVS data sets — sequential data sets and PDS members, with
  z/OS-compatible SITE keywords for RECFM, LRECL, BLKSIZE, SPACE,
  UNIT and VOLUME.
• JES — quote site filetype=jes: submit a job, list your jobs, retrieve
  and purge spool output.
• UFS — the UFSD filesystem, reached by cd to a UFS path.

UFSD is optional. libufs is linked statically and FTPD asks UFSD for a
session only when a client actually uses a UFS path, so on a system without the
UFSD started task those commands answer 550 UFS service not available and
everything else works normally. The SYSMOD declares no prerequisite — install
FTPD now and add UFSD later if
you want it.

RAKF is not optional

FTPD has no user database of its own. Every USER/PASS is verified by RAKF
(RACINIT, SVC 244), and every data set access is checked against the RAKF
DATASET class under the logged-in user's identity, not the server's. On a
system without RAKF nobody can log in, and no configuration option turns that
off. There is no INSECURE mode; the one that existed during development was
removed on purpose.

The setup is one user, one group and an optional FTPAUTH FACILITY profile —
step 8 of the guide, with the full reference in
FTPD_RAKF_SETUP.md.

Next: 1.1.0 is about authorization

1.0.0 authenticates every session and checks every data set access, but the
identity model around those checks still has known gaps, and that is what the
next release is for. The open work:

• The resting identity is too powerful (#97).
  Between sessions the STC sits on STC/STCGROUP, which holds ALTER on every
  data set. The recovery path can transiently put a session on that identity,
  which is fail-closed only while it is least-privilege — so FTPD needs to log
  on to a low-privilege userid at startup instead.
• JES access has no authorization model at all
  (#90). JESOWNER is a
  client-set display filter, not a control.
• The ACEE switch is not fully serialized
  (#64). ASXBSENV is
  address-space-wide while sessions run as concurrent subtasks.

Until those are closed, keep the FTPD identity scoped to what the started task
itself needs — never give it broad data set authority. The reasoning is spelled
out as a security invariant in the RAKF guide.

---

Full Changelog: https://github.com/mvslovers/ftpd/commits/v1.0.0