# Ensure ftp server services are not in use

The File Transfer Protocol (FTP) is an insecure legacy protocol that transmits credentials and data in cleartext, making it highly susceptible to eavesdropping, credential theft, and man-in-the-middle attacks. Disabling or removing FTP services is a critical security measure to prevent unauthorized access and data breaches. Secure alternatives like SFTP (SSH File Transfer Protocol) or FTPS (FTP over SSL/TLS) should be used instead. Leaving an FTP server running, especially if unpatched or misconfigured, creates a significant attack surface on the system. The audit script verifies if the common `vsftpd` package is installed and whether the associated service is enabled. The remediation script either disables the service or completely removes the package based on the desired state. The Basic recommendation is to disable the service, which prevents it from running but leaves the software on the disk. The Moderate and Strict recommendations align on uninstalling the package entirely, which is the most secure approach as it removes the software and all associated potential vulnerabilities, adhering to the principle of least functionality.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['disabled']` |
| **Moderate** | `['Not Installed']` |
| **Strict** | `['Not Installed']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks for the presence and status of the `vsftpd` service. The script should first check if the `vsftpd` package is installed using `rpm -q vsftpd`. If the package is not installed, the script must return the string 'Not Installed'. If the package is installed, the script must then check if the service is enabled using `systemctl is-enabled vsftpd` and return only the output of that command (e.g., 'enabled' or 'disabled').

## Remediation Script Working

Bash script that accepts one positional argument representing the desired state ('Not Installed' or 'disabled'). If the argument is 'Not Installed', the script must attempt to uninstall the `vsftpd` package using `yum remove -y vsftpd` or `dnf remove -y vsftpd`. If the argument is 'disabled', it must disable and stop the service using `systemctl disable --now vsftpd`. The script must return `true` if the operation is successful and `false` otherwise.

