Detections
Analytics
2.2.1 Ensure ftp client is not installed
Information
FTP (File Transfer Protocol) is a traditional and widely used standard tool for transferring files between a server and clients over a network, especially where no authentication is necessary (permits anonymous users to connect to a server).FTP does not protect the confidentiality of data or authentication credentials. It is recommended SFTP be used if file transfer is required. Unless there is a need to run the system as a FTP server (for example, to allow anonymous downloads), it is recommended that the package be removed to reduce the potential attack surface.
Solution
Run the following command to remove ftp :# dnf remove ftp
Impact:
Removing the ftp client prevents connecting to FTP servers from this host. Where interactive file transfer is required, use sftp or scp instead.
See Also
Item Details
Audit Name: CIS Red Hat Enterprise Linux 9 v3.0.0 L1 Server
Category: CONFIGURATION MANAGEMENT
References: 800-53|CM-6, 800-53|CM-7, CSCv7|9.2
Plugin: Unix
Control ID: fd0f0625cf736e12c8496b74d892a0e649899b3e65d1a923daff96a76c4e2408