Detections
Analytics

2.2.1 Ensure ftp client is not installed

Information

FTP (File Transfer Protocol) is a traditional and widely used standard tool for transferring files between a server and clients over a network, especially where no authentication is necessary (permits anonymous users to connect to a server).

FTP does not protect the confidentiality of data or authentication credentials. It is recommended SFTP be used if file transfer is required. Unless there is a need to run the system as a FTP server (for example, to allow anonymous downloads), it is recommended that the package be removed to reduce the potential attack surface.

Solution

Run the following command to remove ftp :

# dnf remove ftp

See Also

https://workbench.cisecurity.org/benchmarks/24010

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6, 800-53|CM-7, CSCv7|9.2

Plugin: Unix

Control ID: ffbe806af3fe70087e7fb65123ca74d8c8a0eec6b5256ebd48888ceb04d2e50b