UCF STIG Viewer Logo

The ftpusers file must contain account names not allowed to use FTP.


Overview

Finding ID Version Rule ID IA Controls Severity
V-841 GEN004900 SV-62981r1_rule Medium
Description
The ftpusers file contains a list of accounts not allowed to use FTP to transfer files. If the file does not contain the names of all accounts not authorized to use FTP, then unauthorized use of FTP may take place.
STIG Date
Oracle Linux 5 Security Technical Implementation Guide 2020-02-25

Details

Check Text ( C-51767r1_chk )
Check the contents of the ftpusers file.
For gssftp:
# more /etc/ftpusers

For vsftp:
# more /etc/vsftpd.ftpusers /etc/vfsftpd/ftpusers
If the system has accounts not allowed to use FTP and not listed in the ftpusers file, this is a finding.
Fix Text (F-53549r1_fix)
For gssftp:
Add accounts not allowed to use FTP to the /etc/ftpusers file.

For vsftp:
Add accounts not allowed to use FTP to the /etc/vsftpd.ftpusers or /etc/vsftpd/ftpusers file (as appropriate).