# Ensure ftp server services are not in use

Necessity: The File Transfer Protocol (FTP) is an insecure legacy protocol that transmits authentication credentials and data in cleartext. This makes it highly susceptible to eavesdropping, credential theft, and man-in-the-middle attacks. Running an FTP server significantly increases the system's attack surface and introduces unnecessary risk, as any vulnerability in the FTP daemon could be exploited to compromise the entire server. Disabling and removing FTP services is a critical security measure to prevent these threats. Modern, secure alternatives such as SFTP (SSH File Transfer Protocol) or FTPS should be used instead.

Auditing and Remediation: The audit script verifies whether any common FTP server packages (like vsftpd, proftpd, or pure-ftpd) are installed on the system, which is the primary indicator of the service's presence. The remediation script systematically purges these packages, ensuring that the service and its configuration files are completely removed from the system, thereby eliminating the associated security risks.

Recommended State Rationale: The recommended state for Basic, Moderate, and Strict levels is uniformly 'Not Installed'. This is because FTP has fundamental security flaws that cannot be mitigated through configuration alone. There is no 'secure' way to run a standard FTP server. Therefore, the only acceptable security posture, regardless of the hardening level, is the complete absence of the service. Any level of security requires its removal to protect data and system integrity.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Not Installed']` |
| **Moderate** | `['Not Installed']` |
| **Strict** | `['Not Installed']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks for the presence of common FTP server packages (vsftpd, proftpd-basic, pure-ftpd). If any of these packages are installed, the script must return the string 'Installed'. If none are found, it must return 'Not Installed'. The output must contain only one of these two strings and nothing else.

## Remediation Script Working

Bash script that accepts a single positional argument, which must be the string 'Not Installed'. The script should identify and uninstall any common FTP server packages (such as vsftpd, proftpd-basic, pure-ftpd) from the system using 'apt-get purge'. It must return 'true' upon successful removal of all found packages or if no packages were installed to begin with. It must return 'false' if the uninstallation fails or if the provided argument is not 'Not Installed'.

