Uninstall vsftpd Package
Ensures the vsftpd FTP server package is not installed.
Checked against what is installed or registered, packages present/absent, account databases.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
vsftpd is an FTP server. FTP transmits credentials and data in clear text, so it offers no confidentiality or integrity and is trivially sniffed or tampered with on the network. Removing the package eliminates the risk of the service being accidentally or intentionally started, and reduces the host's attack surface. Where file transfer is genuinely required, use sftp/scp over SSH or FTPS instead.
What Pavois checks
Pavois queries the package database via the InSpec package('vsftpd') resource (rpm -q / dpkg -s). Checking the package itself, rather than only whether the port 21 listener is up right now, guarantees the service cannot be started later by a reboot, a dependency, or an operator; if the package is absent, the vsftpd unit does not exist at all.
describe package('vsftpd') do
it { should_not be_installed }
endHow to verify it is applied
On RHEL-family: rpm -q vsftpd → package vsftpd is not installed. On Debian/Ubuntu: dpkg -s vsftpd → dpkg-query: package 'vsftpd' is not installed. You can also confirm nothing listens on FTP with ss -lntp | grep ':21' returning no rows.
Inspect & investigate
- Package state:
rpm -q vsftpd/dpkg -s vsftpd; removal recorded in/var/log/dnf.rpm.logor/var/log/dpkg.log. - Past FTP activity (before removal):
journalctl -u vsftpdand/var/log/vsftpd.log.
Remediation
Pavois's harden plan declares a package resource for vsftpd with action remove, so pavois harden apply uninstalls it (dnf remove vsftpd / apt-get purge vsftpd). Removing the package also removes the vsftpd service unit, so no restart is needed.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | remove |
|---|---|
| name | vsftpd |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Leaving vsftpd installed keeps a clear-text FTP server available that can be started and become a credential-leak and data-tampering vector. Before applying: verify no workflow depends on this host serving FTP, check ss -lntp | grep ':21' and systemctl is-enabled vsftpd. If FTP is in use, migrate clients to sftp/FTPS first, otherwise file-transfer integrations will break. Removal does not affect SSH, so there is no remote-management lockout risk.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 2.1.6, 2.1.7 | direct | per OS, see the benchmark table | high |
| NIST | CM-6(a), CM-7, CM-7(a), CM-7(b), IA-5(1)(c), IA-5(1).1(v) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.