documentation_complete: true

title: 'Restrict Access to Anonymous Users if Possible'

description: |-
    Is there a mission-critical reason for users to transfer files to/from their own accounts using FTP, rather than
    using a secure protocol like SCP/SFTP? If not, edit the vsftpd configuration file. Add or correct the following configuration option:
    <pre>local_enable=NO</pre>
    If non-anonymous FTP logins are necessary, follow the guidance in the remainder of this section to secure
    these logins as much as possible.

rationale: 'The use of non-anonymous FTP logins is strongly discouraged. Since SSH clients and servers are widely available, and since SSH provides support for a transfer mode which resembles FTP in user interface, there is no good reason to allow password-based FTP access.'

severity: unknown

identifiers:
    cce: 27115-5

references:
    nist: CM-7,AC-3
