Unencrypted FTP must not be used on the system.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-12010	GEN004800	SV-35098r1_rule	ECSC-1	Medium

Description
FTP is typically unencrypted and, therefore, presents confidentiality and integrity risks. FTP may be protected by encryption in certain cases, such as when used in a Kerberos environment. SFTP and FTPS are encrypted alternatives to FTP.

STIG	Date
HP-UX 11.31 Security Technical Implementation Guide	2018-09-14

Details

Check Text ( C-36579r3_chk )
Determine if unencrypted FTP is enabled. # cat /etc/inetd.conf | sed -e 's/^[ \t]*//' | tr '\011' ' ' | tr -s ' ' | grep -v "^#" | grep -c -i "^ftp" If the service is found (i.e., the command returns a non-zero value), and not commented, ask the SA if this service is encrypted. If not, this is a finding.

Fix Text (F-31947r2_fix)
Edit /etc/inetd.conf and comment out or remove the ftp service. Refresh the inet daemon. inetd -c