UCF STIG Viewer Logo

The ftpusers file must contain account names not allowed to use FTP.


Overview

Finding ID Version Rule ID IA Controls Severity
V-841 GEN004900 SV-35103r1_rule ECCD-1 ECCD-2 Medium
Description
The ftpusers file contains a list of accounts not allowed to use FTP to transfer files. If the file does not contain the names of all accounts not authorized to use FTP, then unauthorized use of FTP may take place.
STIG Date
HP-UX 11.23 Security Technical Implementation Guide 2015-12-02

Details

Check Text ( C-36583r1_chk )
Check the contents of the ftpusers file.
# more /etc/ftpd/ftpusers
OR alternatively
# find / -type f -name ftpusers -exec ls -lL {} \;

If the system has accounts not allowed to use FTP and not
listed in the ftpusers file, this is a finding.

Fix Text (F-31951r1_fix)
Add accounts not allowed to use FTP to the
/etc/ftpd/ftpusers (or equivalent) file.