---
title: "HOST-SVC-005 FTP Server Installed or Enabled"
canonical: https://openvapt.com/checks/HOST-SVC-005.html
html: https://openvapt.com/checks/HOST-SVC-005.html
site: OpenVAPT, https://openvapt.com/
license: OpenVAPT Source-Available Licence 1.3, https://openvapt.com/legal/licence-text.html
modified: 2026-10-14
version: 0.1.0-alpha.6
---

# HOST-SVC-005 FTP Server Installed or Enabled

Checks whether an FTP server (vsftpd, ProFTPD or Pure-FTPd) is installed or set to start at boot.

- Domain: Server
- Severity: Medium
- Control category: Secure Configuration
- Fix effort: low
- CVSS v3.1 vector: `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N`
- CIS Controls v8: 4.8
- NIST CSF 2.0: PR.PS-01, PR.IR-01
- CWE: CWE-319, CWE-1188
- NIST SP 800-53 Rev. 5: CM-7, CM-7(1), SC-8
- Benchmark topic: FTP server is not installed (CIS Controls v8 4.8) (topic only, no benchmark text)

## Why It Matters

Plain FTP sends passwords and files unencrypted and needs a wide range of ports open. SFTP over SSH, which the SSH server already provides, does the same job encrypted. An FTP server is usually a leftover from a web hosting panel. If this machine is one of the hosts that must serve legacy FTP clients that legitimately run it, record the reason in the suppression file so the finding stays visible but accepted.

## How It Detects

Reads installed packages from /var/lib/dpkg/status (only entries marked 'install ok installed'; /var/lib/dpkg/info/*.list is a fallback used only when the status file cannot be read) and the allow-listed rpm -qa, and looks for vsftpd, proftpd-core, proftpd-basic, proftpd, pure-ftpd, pure-ftpd-common. Reads the *.wants links under /etc/systemd/system (and asks the allow-listed systemctl is-enabled) for vsftpd.service, proftpd.service, pure-ftpd.service. Either an installed package or an enabled unit fails. Incomplete when no package database and no systemd unit directory could be read.

## How to Fix

Move users to SFTP (the OpenSSH internal-sftp subsystem), then  apt purge vsftpd proftpd-core pure-ftpd  or  dnf remove vsftpd proftpd  and  systemctl disable --now vsftpd . If FTP must stay, enforce TLS (FTPS) and restrict it to named users. Before removing a package, check that no application on this machine or the network still uses the service, and keep console access when the service is remote-access related.

## How to Verify

```
dpkg -l vsftpd proftpd-core proftpd-basic proftpd pure-ftpd pure-ftpd-common 2>/dev/null | grep '^ii' ; systemctl is-enabled vsftpd.service proftpd.service pure-ftpd.service 2>/dev/null
```

## Learn the Theory

- [P1 Linux Server Hardening](https://openvapt.com/academy/p1.md)
- [P22 Authentication Policy and Package Hygiene](https://openvapt.com/academy/p22.md)

## References

- [MITRE ATT&CK T1040, Network Sniffing](https://attack.mitre.org/techniques/T1040/)
- [NIST SP 800-123, Guide to General Server Security](https://csrc.nist.gov/pubs/sp/800/123/final)

## Source Code

https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/legacy_services.go

Run it: `openvapt scan --only HOST-SVC-005`. Read it offline: `openvapt explain HOST-SVC-005`.

---

OpenVAPT is academic, non-commercial, source-available and built by AI Cybersecurity Engineers (AI systems, not people). Free for your own use on machines you own or control, 100% at your own risk; not for sale and not for providing services. This page in HTML: https://openvapt.com/checks/HOST-SVC-005.html. Part of OpenVAPT Check Catalogue. How to cite: https://openvapt.com/cite.html. Site summary for models: https://openvapt.com/llms.txt.