FTP Port from 21 to 211

Question

Greetings,
I have an:
Xserve
2x 2GHz Dual-Core Intel Xeon
2GB 667 MHz FB-DIMM
Trying to reconfigure the FTP port from 21 to 211 (or any other, except 21).
How do I tell the Xserve to listen for that particular port for FTP instead of 21?
I already forwarded the port 211 to the IP address assigned to the Xserve.
Thank you.

Answer 1

First let me preface this by saying I think this is a really bad idea.
There are two common reasons for using non-standard ports for services. One is to circumvent network filters (such as those imposed by an ISP), the other is to hide the fact you're running a particular server.
In the former, there are usually easier ways to overcome that, for example, port forwarding at the router, tunneling over SSH or a VPN, or using a different protocol SFTP, for example.
In the latter you're largely wasting your time since any serious hacker isn't trying any particular port to get into your machine, they run a port scan and analyze whatever responds. Any worthy hacker (is that a legitimate term? ) will know almost immediately what kind of service is running on any given port.
In addition to all of that, FTP is a major PITA due to its use of multiple ports. While you may use port x for the FTP control connection, you typically use port x-1 for the data connection, meaning you need to open port 210 as well as 211.
Then comes the future. Running non-standard ports requires that you remember the changes and re-apply them after any future updates - Apple have a habit of updating files they don't expect users to change and you may find that FTP reverts to a standard port without you realizing.
That said, FTP's main control file is /System/Library/LaunchDaemons/ftp.plist.
In there you'll find the part that tells FTP which network ports to listen to:
<key>Sockets</key>
 <dict>
  <key>Listeners</key>
  <dict>
   <key>SockServiceName</key>
   <string>ftp</string>
   <key>Bonjour</key>
   <true/>
  </dict>
 </dict>
The SockServiceName is the relevant part - in this case it tells the daemon to listen on the 'ftp' port.
At this point you have two options - either tell it to use a different port, or redefine what 'ftp' relates to.
In the first option, I think (but haven't confirmed) you can just change the <string>ftp</string> with an alternate port number, e.g.:
   <key>SockServiceName</key>
   <string>211</string>
The other option is to edit the file /etc/services (which is where the daemon looks up the port names) and redefine the ftp port number:
ftp 21/udp # File Transfer [Control]
ftp 21/tcp # File Transfer [Control]
Change both these numbers to 22. You may also need to change the 'ftp-data' ports listed immediately above in the file.
As mentioned before, whichever option you choose (.plist or /etc/services) you should be prepared to re-apply the change if Apple overwrites them.
If you're running a firewall you will also need to edit your firewall rules to match the new port numbers.