Title

The FTP daemon must be configured for logging or verbose mode. (Cat III impact)

Discussion

The -l option allows basic logging of connections. The verbose (on HP) and the debug (on Solaris) allow logging of what files the FTP session transferred. This extra logging makes it possible to easily track which files are being transferred onto or from a system. If they are not configured, the only option for tracking is the audit files. The audit files are much harder to read. If auditing is not properly configured, then there would be no record at all of the file transfer transactions.

Check Content

Verify the FTP daemon is invoked with the -l option by SMF. # inetadm -l ftp | grep in.ftpd If the exec name-value pair does not include the -l option for in.ftpd, this is a finding.

Fix Text

Add the -l option to the exec name-value pair used by SMF to invoke the FTP daemon. # inetadm -m ftp exec="/usr/sbin/in.ftpd [other options] -l" Refresh inetd. # svcadm refresh inetd

Additional Identifiers

Rule ID: SV-227861r603266_rule

Vulnerability ID: V-227861

Group Title: SRG-OS-000037

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.