V-269403

Discussion

Passwords must be protected at all times, and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. An FTP server provides an unencrypted file transfer mechanism that does not protect the confidentiality of user credentials or the remote session. If a privileged user were to log on using this service, the privileged user password could be compromised. SFTP or other encrypted file transfer methods must be used instead. Removing the server and client packages prevents inbound and outbound communications from being compromised.

Check Content

Verify that AlmaLinux OS 9 does not have an FTP client or server package installed with the following command:

$ rpm -qa | grep ftp

If the "vsftpd" server or "ftp" client packages are installed, this is a finding.

Note that there may be third-party or alternative packages that provide the same functionality, which should also be removed.