UCF STIG Viewer Logo

Unencrypted FTP must not be used on the system.


Overview

Finding ID Version Rule ID IA Controls Severity
V-12010 GEN004800 SV-39176r2_rule Medium
Description
FTP is typically unencrypted and, therefore, presents confidentiality and integrity risks. FTP may be protected by encryption in certain cases, such as when used in a Kerberos environment. SFTP and FTPS are encrypted alternatives to FTP.
STIG Date
AIX 6.1 SECURITY TECHNICAL IMPLEMENTATION GUIDE 2018-09-18

Details

Check Text ( C-38153r3_chk )
Determine if unencrypted ftp is enabled.

Procedure:
# grep ftp /etc/inetd.conf

If the service is found and is active, ask the SA if it is encrypted.

If it is not, this is a finding.
Fix Text (F-33430r2_fix)
Edit /etc/inetd.conf and comment out or remove the ftp service line.

# vi /etc/inetd.conf

Restart the inetd service.

# refresh -s inetd