Disable file transfer and file sharing server services the system does not provide

Description

File transfer and sharing daemons packaged by Debian:

• FTP: vsftpd, proftpd (service and socket), pure-ftpd;
• TFTP: tftpd-hpa, atftpd (service and socket);
• rsync in daemon mode: rsync;
• Samba: smbd, nmbd, samba-ad-dc.

The control passes when each unit is masked or not installed at all.

A unit that does not exist counts as compliant, so removing the package is an equally valid fix. The rsync package ships rsync.service disabled; it still fails this control until masked, because any package or administrator can enable it.

Rationale

FTP and TFTP send data, and FTP also passwords, without encryption. TFTP has no authentication at all. rsync and Samba daemons publish directories on the network. Each of them is remotely reachable code and a path for data to leave the system.

Impact

Masking a unit stops it and prevents it from starting again. Client tools are not affected: rsync over SSH and smbclient keep working. File servers must exclude this control in their tailoring file.

Audit

For each unit, run systemctl is-enabled <unit>. It must print masked, or fail because the unit does not exist: vsftpd.service, proftpd.service, proftpd.socket, pure-ftpd.service, tftpd-hpa.service, atftpd.service, atftpd.socket, rsync.service, smbd.service, nmbd.service, samba-ad-dc.service.

Automated: every check must pass. Scanners report each check by its id.

vsftpd

vsftpd FTP server.

unit: vsftpd.service
state: masked

proftpd

ProFTPD FTP server.

unit: proftpd.service
state: masked

proftpd-socket

ProFTPD socket activation.

unit: proftpd.socket
state: masked

pure-ftpd

Pure-FTPd FTP server.

unit: pure-ftpd.service
state: masked

tftpd-hpa

tftp-hpa TFTP server.

unit: tftpd-hpa.service
state: masked

atftpd

atftpd TFTP server.

unit: atftpd.service
state: masked

atftpd-socket

atftpd socket activation.

unit: atftpd.socket
state: masked

rsync

rsync daemon.

unit: rsync.service
state: masked

smbd

Samba file server.

unit: smbd.service
state: masked

nmbd

Samba NetBIOS name server.

unit: nmbd.service
state: masked

samba-ad-dc

Samba Active Directory domain controller.

unit: samba-ad-dc.service
state: masked

Remediation

Stop and mask each unit that is installed: systemctl mask --now <unit>. If the package is not needed at all, remove it instead, for example apt purge vsftpd tftpd-hpa samba.

Rollback

Run systemctl unmask <unit> then systemctl enable --now <unit>.

vsftpd

Generated from check vsftpd: the engine writes the fix for every output, it sets the expected value and the check runs again after.

proftpd

Generated from check proftpd: the engine writes the fix for every output, it sets the expected value and the check runs again after.

proftpd-socket

Generated from check proftpd-socket: the engine writes the fix for every output, it sets the expected value and the check runs again after.

pure-ftpd

Generated from check pure-ftpd: the engine writes the fix for every output, it sets the expected value and the check runs again after.

tftpd-hpa

Generated from check tftpd-hpa: the engine writes the fix for every output, it sets the expected value and the check runs again after.

atftpd

Generated from check atftpd: the engine writes the fix for every output, it sets the expected value and the check runs again after.

atftpd-socket

Generated from check atftpd-socket: the engine writes the fix for every output, it sets the expected value and the check runs again after.

rsync

Generated from check rsync: the engine writes the fix for every output, it sets the expected value and the check runs again after.

smbd

Generated from check smbd: the engine writes the fix for every output, it sets the expected value and the check runs again after.

nmbd

Generated from check nmbd: the engine writes the fix for every output, it sets the expected value and the check runs again after.

samba-ad-dc

Generated from check samba-ad-dc: the engine writes the fix for every output, it sets the expected value and the check runs again after.

Each release turns these fixes into remediate.sh and an Ansible role per profile: dry run by default, a fix runs only when its check fails.

References

• systemctl(1), Debian manual pages Debian, vendor-doc, accessed 2026-10-18
• vsftpd(8), Debian manual pages Debian, vendor-doc, accessed 2026-10-18
• tftpd(8), Debian manual pages Debian, vendor-doc, accessed 2026-10-18
• rsyncd.conf(5), Debian manual pages Debian, vendor-doc, accessed 2026-10-18
• smbd(8), Debian manual pages Debian, vendor-doc, accessed 2026-10-18
• ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R62) ANSSI, guide, accessed 2026-10-18

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

People and lifecycle