Disable vsftpd Service
Ensures the FTP server vsftpd.service is disabled and not running so the host does not expose a cleartext FTP service.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
Running an FTP server (vsftpd) opens a network-based avenue of attack and should be disabled when not explicitly required. Plain FTP transmits credentials and data in cleartext, risking interception and credential theft, and the listener itself is an additional service to patch and harden. Under the principle of least functionality, hosts that do not need to serve files over FTP should not run vsftpd; use SFTP/HTTPS where file transfer is needed.
What Pavois checks
Pavois reads the effective unit state via service('vsftpd.service') (systemctl is-enabled / is-active), accounting for drop-in overrides and socket activation. This catches a vsftpd listener that is actually enabled/running even if /etc/vsftpd.conf looks dormant, the running state, not the config file, is what exposes the network.
describe service('vsftpd.service') do
it { should_not be_enabled }
it { should_not be_running }
endHow to verify it is applied
Run systemctl is-enabled vsftpd.service (expect disabled/masked/not found) and systemctl is-active vsftpd.service (expect inactive). Confirm nothing is listening on TCP/21 with ss -lntp | grep ':21' (expected: no output).
Inspect & investigate
Unit transitions and connection activity are in journalctl -u vsftpd.service; vsftpd transfer/login logs default to /var/log/vsftpd.log (and auth attempts to /var/log/auth.log). Confirm the listener is gone with ss -lntp | grep ':21'.
Remediation
Pavois's harden plan acts on the service resource named vsftpd: it runs disable and stop so the FTP server does not start at boot and is stopped now. It is applied with pavois harden apply. If FTP is not needed at all, also remove the vsftpd package to eliminate the binary and its socket entirely.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | disable, stop |
|---|---|
| name | vsftpd |
| resource | service |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Disabling vsftpd breaks any workflow that depends on this host serving files over FTP (legacy uploads, appliance integrations, anonymous file drops). Precautions: inventory clients hitting TCP/21 before disabling; migrate them to SFTP (over the existing SSH service) or HTTPS; and if FTP is genuinely required, keep it only with FTPS/TLS, restrict it to the necessary network segment, and firewall the data/control ports.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 2.1.6 | direct | per OS, see the benchmark table | high |
| NIST | CM-7(a), CM-7(b), CM-6(a) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.