FTP Server Installed or Enabled

Checks whether an FTP server (vsftpd, ProFTPD or Pure-FTPd) is installed or set to start at boot.

Why It Matters

Plain FTP sends passwords and files unencrypted and needs a wide range of ports open. SFTP over SSH, which the SSH server already provides, does the same job encrypted. An FTP server is usually a leftover from a web hosting panel. If this machine is one of the hosts that must serve legacy FTP clients that legitimately run it, record the reason in the suppression file so the finding stays visible but accepted.

How It Detects

Reads installed packages from /var/lib/dpkg/status (only entries marked 'install ok installed'; /var/lib/dpkg/info/*.list is a fallback used only when the status file cannot be read) and the allow-listed rpm -qa, and looks for vsftpd, proftpd-core, proftpd-basic, proftpd, pure-ftpd, pure-ftpd-common. Reads the *.wants links under /etc/systemd/system (and asks the allow-listed systemctl is-enabled) for vsftpd.service, proftpd.service, pure-ftpd.service. Either an installed package or an enabled unit fails. Incomplete when no package database and no systemd unit directory could be read.

How to Fix

Move users to SFTP (the OpenSSH internal-sftp subsystem), then apt purge vsftpd proftpd-core pure-ftpd or dnf remove vsftpd proftpd and systemctl disable --now vsftpd . If FTP must stay, enforce TLS (FTPS) and restrict it to named users. Before removing a package, check that no application on this machine or the network still uses the service, and keep console access when the service is remote-access related.

How to Verify

dpkg -l vsftpd proftpd-core proftpd-basic proftpd pure-ftpd pure-ftpd-common 2>/dev/null | grep '^ii' ; systemctl is-enabled vsftpd.service proftpd.service pure-ftpd.service 2>/dev/null

CVSS v3.1 Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Control Category

Secure Configuration: CIS Controls v8 4; NIST CSF 2.0 PR.PS

Fix Effort

Low

CIS Controls v8 Safeguard

4.8

NIST CSF 2.0 Subcategory

PR.PS-01, PR.IR-01

CWE

CWE-319, CWE-1188

NIST SP 800-53 Rev. 5

CM-7, CM-7(1), SC-8

Benchmark Topic

FTP server is not installed (CIS Controls v8 4.8) (topic only, no benchmark text)

References

MITRE ATT&CK T1040, Network Sniffing
NIST SP 800-123, Guide to General Server Security

Source Code

The complete file that defines this check. Run it with openvapt scan --only HOST-SVC-005, or read it offline with openvapt explain HOST-SVC-005.

Also available as plain Markdown for notes, scripts and AI tools. Same facts, same source, no styling.

OpenVAPT. (2026). HOST-SVC-005 FTP Server Installed or Enabled (Version 0.1.0-alpha.6). OpenVAPT Check Catalogue. Retrieved October 16, 2026, from https://openvapt.com/checks/HOST-SVC-005.html

@misc{openvapt_host_svc_005,
  author       = {{OpenVAPT}},
  title        = {{HOST-SVC-005 FTP Server Installed or Enabled}},
  year         = {2026},
  howpublished = {\url{https://openvapt.com/checks/HOST-SVC-005.html}},
  note         = {OpenVAPT Check Catalogue, version 0.1.0-alpha.6. Accessed 16 October 2026}
}