Remove tnftp Package
Ensures the tnftp FTP client package is not installed.
Checked against what is installed or registered, packages present/absent, account databases.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
tnftp is an enhanced FTP client. Standard FTP transmits credentials and data in cleartext and is largely obsolete. Unless the system genuinely needs Internet-standard FTP (e.g. for anonymous downloads), removing the client cuts an insecure transfer path and reduces the potential attack surface.
What Pavois checks
Pavois verifies that the tnftp package is absent from the package database. The presence of the client binary is the relevant exposure (users could open cleartext FTP sessions), so querying the package manager directly is the authoritative signal.
describe package('tnftp') do
it { should_not be_installed }
endHow to verify it is applied
Run dpkg -s tnftp and expect package 'tnftp' is not installed.
Inspect & investigate
Removal is recorded in grep tnftp /var/log/dpkg.log.
Remediation
Pavois's harden plan declares the tnftp package resource with action remove, so pavois harden apply uninstalls the client via apt.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | remove |
|---|---|
| name | tnftp |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Removing the tnftp client is low-risk on most servers. Precaution: if any script or mirror job fetches files from an FTP server using tnftp/ftp, migrate it to an encrypted/authenticated transfer (SFTP/SCP/HTTPS) before removing the package, or those jobs will fail.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 2.2.6 | direct | per OS, see the benchmark table | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.