Check: RHEL-09-215015
RHEL 9 STIG:
RHEL-09-215015
(in versions v1 r3 through v1 r1)
Title
RHEL 9 must not have a File Transfer Protocol (FTP) server package installed. (Cat I impact)
Discussion
The FTP service provides an unencrypted remote access that does not provide for the confidentiality and integrity of user passwords or the remote session. If a privileged user were to log on using this service, the privileged user password could be compromised. SSH or other encrypted file transfer methods must be used in place of this service. Removing the "vsftpd" package decreases the risk of accidental activation. Satisfies: SRG-OS-000074-GPOS-00042, SRG-OS-000095-GPOS-00049, SRG-OS-000480-GPOS-00227
Check Content
Verify that RHEL 9 does not have a File Transfer Protocol (FTP) server package installed with the following command: $ sudo dnf list --installed | grep ftp If the "ftp" package is installed, this is a finding.
Fix Text
The ftp package can be removed with the following command (using vsftpd as an example): $ sudo dnf remove vsftpd
Additional Identifiers
Rule ID: SV-257826r925465_rule
Vulnerability ID: V-257826
Group Title: SRG-OS-000074-GPOS-00042
Expert Comments
CCIs
| Number | Definition |
|---|---|
| CCI-000197 |
The information system, for password-based authentication, transmits only cryptographically-protected passwords. |
| CCI-000366 |
The organization implements the security configuration settings. |
| CCI-000381 |
The organization configures the information system to provide only essential capabilities. |