| VID |
14110 |
| Severity |
30 |
| Port |
22 |
| Protocol |
TCP |
| Class |
LSC |
| Detailed Description |
The FTP service should be restricted to use FTP service unless it is absolutely necessary, since the ID and password are transmitted unencrypted and the ID and password may be exposed even by a simple sniffer.
Inevitably, if you need to use the FTP service, you should restrict the direct access of the root account so that the password information of the root account is not exposed.
* Affected platforms:
UNIX, Linux |
| Recommendation |
Take the following steps to restrict the root account
1. Open the ftpusers file ("/etc/ftpusers" or "/etc/ftpd/ftpusers")
#vi /etc/ftpusers or /etc/ftpd/ftpusers
2. Add root account or uncomment root in ftpusers file
(Before) #root Or, root account unregistered
(After) root |
| Related URL |
(CVE) |
| Related URL |
(SecurityFocus) |
| Related URL |
(ISS) |
|
