{
  "id": "CB-UBU-SVC-002",
  "standard": "ubuntu",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/ubuntu/CB-UBU-SVC-002",
  "json": "https://baselines.cirsec.org/b/ubuntu/CB-UBU-SVC-002.json",
  "yaml": "https://baselines.cirsec.org/b/ubuntu/CB-UBU-SVC-002.yml",
  "profiles_effective": [
    "core",
    "server",
    "server-hardened",
    "desktop",
    "desktop-hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-UBU-SVC-002",
    "title": "Disable file transfer and file sharing server services the system does not provide",
    "finding": {
      "title": "FTP, TFTP, rsync or Samba servers can run on a system that does not provide them",
      "description": "An unneeded file server exposes data and often sends credentials in clear text."
    },
    "status": "active",
    "profiles": [
      "core"
    ],
    "risk": {
      "severity": "medium"
    },
    "assessment": "automated",
    "tags": [
      "services",
      "ftp",
      "tftp",
      "rsync",
      "samba",
      "attack-surface"
    ],
    "description": "File transfer and sharing daemons packaged by Ubuntu:\n\n- FTP: `vsftpd`, `proftpd` (service and socket), `pure-ftpd`;\n- TFTP: `tftpd-hpa`, `atftpd` (service and socket);\n- rsync in daemon mode: `rsync`;\n- Samba: `smbd`, `nmbd`, `samba-ad-dc`.\n\nThe control passes when each unit is masked or not installed at all.\n",
    "rationale": "FTP and TFTP send data, and FTP also passwords, without encryption. TFTP has no authentication\nat all. rsync and Samba daemons publish directories on the network. Each of them is remotely\nreachable code and a path for data to leave the system.\n",
    "impact": "Masking a unit stops it and prevents it from starting again. Client tools are not affected:\n`rsync` over SSH and `smbclient` keep working. File servers must exclude this control in their\ntailoring file.\n",
    "notes": "A unit that does not exist counts as compliant, so removing the package is an equally valid\nfix. Ubuntu installs the `rsync` package by default (it is part of the standard system), with\n`rsync.service` enabled but idle on 20.04 and disabled on later releases; it still fails this\ncontrol until masked, because any package or administrator can enable it. Masking the unit does\nnot affect the `rsync` command.\n",
    "audit": {
      "manual": "For each unit, run `systemctl is-enabled <unit>`. It must print `masked`, or fail because the\nunit does not exist: `vsftpd.service`, `proftpd.service`, `proftpd.socket`,\n`pure-ftpd.service`, `tftpd-hpa.service`, `atftpd.service`, `atftpd.socket`,\n`rsync.service`, `smbd.service`, `nmbd.service`, `samba-ad-dc.service`.\n",
      "logic": "all",
      "checks": [
        {
          "id": "vsftpd",
          "engine": "systemd-unit",
          "description": "vsftpd FTP server.",
          "spec": {
            "unit": "vsftpd.service",
            "state": "masked"
          }
        },
        {
          "id": "proftpd",
          "engine": "systemd-unit",
          "description": "ProFTPD FTP server.",
          "spec": {
            "unit": "proftpd.service",
            "state": "masked"
          }
        },
        {
          "id": "proftpd-socket",
          "engine": "systemd-unit",
          "description": "ProFTPD socket activation.",
          "spec": {
            "unit": "proftpd.socket",
            "state": "masked"
          }
        },
        {
          "id": "pure-ftpd",
          "engine": "systemd-unit",
          "description": "Pure-FTPd FTP server.",
          "spec": {
            "unit": "pure-ftpd.service",
            "state": "masked"
          }
        },
        {
          "id": "tftpd-hpa",
          "engine": "systemd-unit",
          "description": "tftp-hpa TFTP server.",
          "spec": {
            "unit": "tftpd-hpa.service",
            "state": "masked"
          }
        },
        {
          "id": "atftpd",
          "engine": "systemd-unit",
          "description": "atftpd TFTP server.",
          "spec": {
            "unit": "atftpd.service",
            "state": "masked"
          }
        },
        {
          "id": "atftpd-socket",
          "engine": "systemd-unit",
          "description": "atftpd socket activation.",
          "spec": {
            "unit": "atftpd.socket",
            "state": "masked"
          }
        },
        {
          "id": "rsync",
          "engine": "systemd-unit",
          "description": "rsync daemon.",
          "spec": {
            "unit": "rsync.service",
            "state": "masked"
          }
        },
        {
          "id": "smbd",
          "engine": "systemd-unit",
          "description": "Samba file server.",
          "spec": {
            "unit": "smbd.service",
            "state": "masked"
          }
        },
        {
          "id": "nmbd",
          "engine": "systemd-unit",
          "description": "Samba NetBIOS name server.",
          "spec": {
            "unit": "nmbd.service",
            "state": "masked"
          }
        },
        {
          "id": "samba-ad-dc",
          "engine": "systemd-unit",
          "description": "Samba Active Directory domain controller.",
          "spec": {
            "unit": "samba-ad-dc.service",
            "state": "masked"
          }
        }
      ]
    },
    "remediation": {
      "manual": "Stop and mask each unit that is installed: `systemctl mask --now <unit>`. If the package is not\nneeded at all, remove it instead, for example `apt purge vsftpd tftpd-hpa samba`.\n",
      "effects": {
        "restart": "none",
        "disruption": "low",
        "lockout_risk": false
      },
      "rollback": "Run `systemctl unmask <unit>` then `systemctl enable --now <unit>`.\n",
      "scripts": [
        {
          "id": "vsftpd",
          "from_check": "vsftpd"
        },
        {
          "id": "proftpd",
          "from_check": "proftpd"
        },
        {
          "id": "proftpd-socket",
          "from_check": "proftpd-socket"
        },
        {
          "id": "pure-ftpd",
          "from_check": "pure-ftpd"
        },
        {
          "id": "tftpd-hpa",
          "from_check": "tftpd-hpa"
        },
        {
          "id": "atftpd",
          "from_check": "atftpd"
        },
        {
          "id": "atftpd-socket",
          "from_check": "atftpd-socket"
        },
        {
          "id": "rsync",
          "from_check": "rsync"
        },
        {
          "id": "smbd",
          "from_check": "smbd"
        },
        {
          "id": "nmbd",
          "from_check": "nmbd"
        },
        {
          "id": "samba-ad-dc",
          "from_check": "samba-ad-dc"
        }
      ]
    },
    "references": [
      {
        "title": "systemctl(1), Ubuntu manual pages",
        "url": "https://manpages.ubuntu.com/manpages/noble/man1/systemctl.1.html",
        "publisher": "Canonical",
        "kind": "vendor-doc",
        "accessed": "2026-10-19"
      },
      {
        "title": "vsftpd(8), Ubuntu manual pages",
        "url": "https://manpages.ubuntu.com/manpages/noble/man8/vsftpd.8.html",
        "publisher": "Canonical",
        "kind": "vendor-doc",
        "accessed": "2026-10-19"
      },
      {
        "title": "tftpd(8), Ubuntu manual pages",
        "url": "https://manpages.ubuntu.com/manpages/noble/man8/tftpd.8.html",
        "publisher": "Canonical",
        "kind": "vendor-doc",
        "accessed": "2026-10-19"
      },
      {
        "title": "rsyncd.conf(5), Ubuntu manual pages",
        "url": "https://manpages.ubuntu.com/manpages/noble/man5/rsyncd.conf.5.html",
        "publisher": "Canonical",
        "kind": "vendor-doc",
        "accessed": "2026-10-19"
      },
      {
        "title": "smbd(8), Ubuntu manual pages",
        "url": "https://manpages.ubuntu.com/manpages/noble/man8/smbd.8.html",
        "publisher": "Canonical",
        "kind": "vendor-doc",
        "accessed": "2026-10-19"
      },
      {
        "title": "ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R62)",
        "url": "https://messervices.cyber.gouv.fr/documents-guides/fr_np_linux_configuration-v2.0.pdf",
        "publisher": "ANSSI",
        "kind": "guide",
        "accessed": "2026-10-19"
      }
    ],
    "mappings": [
      {
        "framework": "anssi-linux",
        "framework_version": "2.0",
        "id": "R62",
        "relation": "partial",
        "note": "R62 asks to disable every unneeded service; this control covers file transfer and sharing servers."
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "CM-7",
        "relation": "partial"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1210"
      },
      {
        "framework": "mitre-attack",
        "id": "T1048"
      },
      {
        "framework": "cwe",
        "id": "CWE-319"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "verified": [
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "20.04"
        ],
        "environment": "Proxmox VM, Ubuntu 20.04 cloud image, kernel 5.4.0-216-generic",
        "notes": "Stock image fails (rsync.service enabled but idle); with vsftpd, tftpd-hpa and samba installed the checks fail too; fix masks the units, audit passes, unchanged on a second run and after reboot."
      },
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "22.04"
        ],
        "environment": "Proxmox VM, Ubuntu 22.04 cloud image, kernel 5.15.0-198-generic",
        "notes": "Stock image fails (rsync.service disabled); with vsftpd, tftpd-hpa and samba installed the checks fail too; fix masks the units, audit passes, unchanged on a second run and after reboot."
      },
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "24.04"
        ],
        "environment": "Proxmox VM, Ubuntu 24.04 cloud image, kernel 6.8.0-147-generic",
        "notes": "Stock image fails (rsync.service disabled); with vsftpd, tftpd-hpa and samba installed the checks fail too; fix masks the units, audit passes, unchanged on a second run and after reboot."
      },
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "26.04"
        ],
        "environment": "Proxmox VM, Ubuntu 26.04 cloud image, kernel 7.0.0-38-generic",
        "notes": "Stock image fails (rsync.service disabled); with vsftpd, tftpd-hpa and samba installed the checks fail too; fix masks the units, audit passes, unchanged on a second run and after reboot."
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-19",
    "updated": "2026-10-19"
  }
}