Restrict FTP Use

Como é verificado

Método de auditoria: Comando shell

command -v logins >/dev/null 2>&1 || exit 1; out=$( { for user in $(logins -s | awk '{ print $1 }') aiuser noaccess nobody nobody4; do grep -w "$user" /etc/ftpd/ftpusers >/dev/null 2>&1 || echo "User $user not in /etc/ftpd/ftpusers."; done ; } 2>/dev/null ); [ -z "$out" ] && echo compliant || printf '%s\n' "$out" | head -n 20

Saída esperada

compliant

Como é corrigido

Método de correção: Orientação ou patch de infraestrutura

Perform the following to implement the recommended state: # cd /etc/ftpd # cp ftpusers ftpusers.orig # for user in `logins -s | awk '{ print $1 }'` aiuser noaccess nobody nobody4; do $(echo $user >> ftpusers) done # sort -u ftpusers > ftpusers.CIS # mv ftpusers.CIS ftpusers If your site policy states that users have to be authorized to use FTP, consider placing all users in the /etc/ftpd/ftpusers file and then explicitly removing those who are permitted to use the service. To accomplish this, use the command: # getent passwd | cut -f1 -d":" > /etc/ftpd/ftpusers This prohibits any user on the system from using ftp unless they are explicitly removed from the file. Note that this file will need to be updated as users are added to or removed from the system.

Verificar este host

Execute isto em uma máquina que você tenha permissão para auditar. A varredura é somente leitura.

tmaegis scan --target solaris