Check: GEN004820
SUSE Linux Enterprise Server v11 for System z STIG:
GEN004820
(in versions v1 r12 through v1 r9)
Title
Anonymous FTP must not be active on the system unless authorized. (Cat II impact)
Discussion
Due to the numerous vulnerabilities inherent in anonymous FTP, it is not recommended. If anonymous FTP must be used on a system, the requirement must be authorized and approved in the system accreditation package.
Check Content
Attempt to log into this host with a user name of anonymous and a password of guest (also try the password of guest@mail.com). If the logon is successful and the use of anonymous ftp has not been documented and approved by the IAO, this is a finding. Procedure: # ftp localhost Name: anonymous 530 Guest login not allowed on this machine.
Fix Text
Configure the FTP service to not permit anonymous logins.
Additional Identifiers
Rule ID: SV-45877r1_rule
Vulnerability ID: V-846
Group Title: GEN004820
Expert Comments
CCIs
| Number | Definition |
|---|---|
| CCI-001475 |
The organization reviews the proposed content of information prior to posting onto the publicly accessible information system to ensure that nonpublic information is not included. |
Controls
| Number | Title |
|---|---|
| AC-22 |
Publicly Accessible Content |