SV-216358r959010: The use of FTP must be restricted. | Solaris 11 SPARC STIG SCAP Benchmark

Loading benchmark…

Assessment Title

Rule Text

The use of FTP must be restricted.

Description

Discussion Text

FTP is an insecure protocol that transfers files and credentials in clear text, and can be replaced by using SFTP. However, if FTP is permitted for use in the environment, it is important to ensure that the default "system" accounts are not permitted to transfer files via FTP, especially the root role. Consider also adding the names of other privileged or shared accounts that may exist on the system such as user "oracle" and the account which the web server process runs under.

How this relates to the STIG checklist: STIG vs SCAP benchmark.

IA Controls

NIST SP 800-53

Not mappedCCI-000366V-48117SV-60989

References

DPMS Target Solaris 11 SPARC DISA DPMS Target Solaris 11 SPARC 4022

SCC Automation Reference

The reconstructed evaluation script behind this rule's OVAL check(s) — every module a compound check combines, with this rule's own concrete values and DISA's SCC tool's real per-module mechanism curated from static teardown of SCC releases.

#!/bin/bash
# Reconstructed from oval:mil.disa.stig.solaris11:def:72
# The use of FTP must be restricted.
# Per-module read mechanism curated from static teardown of DISA's SCC tool
# (SCAP Compliance Checker) -- see the SCC Automation Reference above.

# Check to see if the FTP service is listed under the SMF.
# smf_object (smf_test)
test_1() {
  ! ( svcs -H -o state svc://localhost/network/ftp:default &>/dev/null )
}
# ftpusers contains aiuser
# textfilecontent54_object (textfilecontent54_test)
test_2() {
  (sed -En 's/^(.*)$/\1/p' '/etc/ftpd/ftpusers') | grep -qxF 'aiuser'
}
# ftpusers contains noaccess
# textfilecontent54_object (textfilecontent54_test)
test_3() {
  (sed -En 's/^(.*)$/\1/p' '/etc/ftpd/ftpusers') | grep -qxF 'noaccess'
}
# ftpusers contains nobody
# textfilecontent54_object (textfilecontent54_test)
test_4() {
  (sed -En 's/^(.*)$/\1/p' '/etc/ftpd/ftpusers') | grep -qxF 'nobody'
}
# ftpusers contains nobody4
# textfilecontent54_object (textfilecontent54_test)
test_5() {
  (sed -En 's/^(.*)$/\1/p' '/etc/ftpd/ftpusers') | grep -qxF 'nobody4'
}
# ftpusers contains all system users
# password_object (password_test)
test_6() {
  ! ( getent passwd ^[^-+].*$ &>/dev/null )
}

if ( test_1 || ( test_2 && test_3 && test_4 && test_5 && test_6 ) ); then
  echo "PASS"
else
  echo "FAIL"
fi

Remediation

The root role is required.

Determine if the FTP server package is installed:

# pkg list service/network/ftp

If the output of this command is:

pkg list: no packages matching 'service/network/ftp' installed

no further action is required.

# for user in `logins -s | awk '{ print $1 }'` \
aiuser noaccess nobody nobody4; do
$(echo $user >> /etc/ftpd/ftpusers)
done
# sort -u /etc/ftpd/ftpusers > /etc/ftpd/ftpusers.temp
# mv /etc/ftpd/ftpusers.temp /etc/ftpd/ftpusers