criticalservicesverified ✓rollback-safe
Ensure vsftpd (FTP server) package is not installed
pkg-vsftpd-absent · RHEL ≥ 8 · 2 impls
Description
The vsftpd FTP server package must not be installed. FTP transmits data including credentials in clear text and should not be used.
Rationale
Removing the FTP server package eliminates the risk of insecure file transfers and reduces the attack surface.
Check → Remediate
Checkpackage_state
- name:
- vsftpd
- state:
- absent
Remediatepackage_absent
- name:
- vsftpd
Framework references
STIG
V-280951 / RHEL-10-200090V-257826 / RHEL-09-215015V-230558
NIST 800-53
CM-7SC-8
Live verification
rhel8:checkrhel9:check
#package#ftp#attack-surface