← Back to SUSE Linux Enterprise Server v11 for System z Security Technical Implementation Guide

V-841

CAT II (Medium)

The ftpusers file must contain account names not allowed to use FTP.

Rule ID

SV-45880r1_rule

STIG

SUSE Linux Enterprise Server v11 for System z Security Technical Implementation Guide

Version

V1R12

CCIs

CCI-000225

Discussion

The ftpusers file contains a list of accounts not allowed to use FTP to transfer files. If the file does not contain the names of all accounts not authorized to use FTP, then unauthorized use of FTP may take place.

Check Content

Check the contents of the ftpusers file. 
For gssftp:
# more /etc/ftpusers

For vsftp:
# more /etc/vsftpd.ftpusers /etc/vfsftpd/ftpusers
If the system has accounts not allowed to use FTP and not listed in the ftpusers file, this is a finding.

Fix Text

For gssftp:
Add accounts not allowed to use FTP to the /etc/ftpusers file.
For vsftp:
Add accounts not allowed to use FTP to the /etc/vfsftpd.ftpusers or /etc/vfsftpd/ftpusers file (as appropriate).