From HP-UX 11.31 Security Technical Implementation Guide
Part of GEN005020
Associated with IA controls: ECSC-1
Associated with: CCI-000366
If an anonymous FTP account does not use a chroot or similarly isolated environment, the system may be more vulnerable to exploits against the FTP service. Such exploits could allow an attacker to gain shell access to the system and view, edit, or remove sensitive files.
Is FTP installed? # ls -lL /usr/lbin/ftpd If ftpd is not installed, this is not a finding. If ftpd is installed, determine if there is an anonymous ftp user configured in /etc/passwd. # cat /etc/passwd | egrep -c "^ftp|^anonymous" The /etc/passwd file, home directory entry for the anonymous FTP user should appear as the following example: ftp:4rL2xXxDatENY:509:159::/home/ftp/./:/usr/bin/false If there is an anonymous ftp user configured in /etc/passwd, determine if the ftp/anonymous user's home directory entry in the /etc/passwd file configured for chroot? # cat /etc/passwd | egrep "^ftp|^anonymous" | cut -f 6,6 -d ":" A dot (.) in field 6 of the FTP /etc/passwd file determines where the chroot will be performed. In the above example, the new root directory is /home/ftp. If an anonymous ftp user is found and the above command does not return an absolute path with a home directory of "dot" (see the above example), this is a finding.
Using the HP-SMH, configure the anonymous FTP service to operate in a chroot environment.
Lavender hyperlinks in small type off to the right (of CSS
class id, if you view the page source) point to
globally unique URIs for each document and item. Copy the
link location and paste anywhere you need to talk
unambiguously about these things.
You can obtain data about documents and items in other
formats. Simply provide an HTTP header Accept:
text/turtle or
Accept: application/rdf+xml.
Powered by sagemincer