UCF STIG Viewer Logo

The FTP daemon must be configured for logging or verbose mode.


Overview

Finding ID Version Rule ID IA Controls Severity
V-227861 GEN004980 SV-227861r603266_rule Low
Description
The -l option allows basic logging of connections. The verbose (on HP) and the debug (on Solaris) allow logging of what files the FTP session transferred. This extra logging makes it possible to easily track which files are being transferred onto or from a system. If they are not configured, the only option for tracking is the audit files. The audit files are much harder to read. If auditing is not properly configured, then there would be no record at all of the file transfer transactions.
STIG Date
Solaris 10 X86 Security Technical Implementation Guide 2022-09-07

Details

Check Text ( C-30023r489976_chk )
Verify the FTP daemon is invoked with the -l option by SMF.
# inetadm -l ftp | grep in.ftpd
If the exec name-value pair does not include the -l option for in.ftpd, this is a finding.
Fix Text (F-30011r489977_fix)
Add the -l option to the exec name-value pair used by SMF to invoke the FTP daemon.
# inetadm -m ftp exec="/usr/sbin/in.ftpd [other options] -l"
Refresh inetd.
# svcadm refresh inetd