Restrict FTP Use

How it is checked

Audit method: Shell command

command -v logins >/dev/null 2>&1 || exit 1; out=$( { for user in $(logins -s | awk '{ print $1 }') aiuser noaccess nobody nobody4; do grep -w "$user" /etc/ftpd/ftpusers >/dev/null 2>&1 || echo "User $user not in /etc/ftpd/ftpusers."; done ; } 2>/dev/null ); [ -z "$out" ] && echo compliant || printf '%s\n' "$out" | head -n 20

Expected output

compliant

How it is fixed

Fix method: Guidance or infrastructure patch

Perform the following to implement the recommended state: # cd /etc/ftpd # cp ftpusers ftpusers.orig # for user in `logins -s | awk '{ print $1 }'` aiuser noaccess nobody nobody4; do $(echo $user >> ftpusers) done # sort -u ftpusers > ftpusers.CIS # mv ftpusers.CIS ftpusers If your site policy states that users have to be authorized to use FTP, consider placing all users in the /etc/ftpd/ftpusers file and then explicitly removing those who are permitted to use the service. To accomplish this, use the command: # getent passwd | cut -f1 -d":" > /etc/ftpd/ftpusers This prohibits any user on the system from using ftp unless they are explicitly removed from the file. Note that this file will need to be updated as users are added to or removed from the system.

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

tmaegis scan --target solaris