<pre>banner_file=/etc/issue</pre>
</description>
<rationale>This setting will cause the system greeting banner to be used for FTP connections as well.</rationale>
@@ -115,10 +114,10 @@ by default. Add or correct the following configuration options:
<!--<oval id="ftp_present_banner" />-->
<!--<ref nist="CM-6, CM-7" /> -->
<ocil clause="it does not">
-To verify this configuration, run the following command:
+To verify this configuration, run the following command.
<pre>grep "banner_file" /etc/vsftpd/vsftpd.conf</pre>
-The output should show the value of <tt>banner_file</tt> is set to <tt>/etc/issue</tt>, an example of which is shown below:
+The output should show the value of <tt>banner_file</tt> is set to <tt>/etc/issue</tt>, an example of which is shown below.
<pre># grep "banner_file" /etc/vsftpd/vsftpd.conf
banner_file=/etc/issue</pre>
</ocil>
@@ -133,7 +132,7 @@ identified need for this access.</description>
<Rule id="ftp_restrict_to_anon">
<title>Restrict Access to Anonymous Users if Possible</title>
<description>Is there a mission-critical reason for users to transfer files to/from their own accounts using FTP, rather than
-using a secure protocol like SCP/SFTP? If not, edit the vsftpd configuration file. Add or correct the following configuration option:
+using a secure protocol like SCP/SFTP? If not, edit the vsftpd configuration file. Add or correct the following configuration option.
<pre>local_enable=NO</pre>
If non-anonymous FTP logins are necessary, follow the guidance in the remainder of this section to secure
these logins as much as possible.</description>
@@ -145,13 +144,13 @@ these logins as much as possible.</description>
<Group id="ftp_limit_users">
<title>Limit Users Allowed FTP Access if Necessary</title>
-<description>If there is a mission-critical reason for users to access their accounts via the insecure FTP protocol, limit the set of users who are allowed this access. Edit the vsftpd configuration file. Add or correct the following configuration options:
+<description>If there is a mission-critical reason for users to access their accounts via the insecure FTP protocol, limit the set of users who are allowed this access. Edit the vsftpd configuration file. Add or correct the following configuration options.
<pre>userlist_enable=YES
userlist_file=/etc/vsftp.ftpusers
userlist_deny=NO</pre>
Edit the file <tt>/etc/vsftp.ftpusers</tt>. For each user USERNAME who should be allowed to access the system via ftp, add a line containing that user's name.
<pre>USERNAME</pre>
-If anonymous access is also required, add the anonymous usernames to <tt>/etc/vsftp.ftpusers</tt> as well:
+If anonymous access is also required, add the anonymous usernames to <tt>/etc/vsftp.ftpusers</tt> as well.
<pre>anonymous
ftp</pre>
</description>
@@ -165,8 +164,8 @@ ftp</pre>
<Rule id="ftp_disable_uploads">
<title>Disable FTP Uploads if Possible</title>
-<description>Is there a mission-critical reason for users to upload files via FTP? If not:
-Edit the vsftpd configuration file. Add or correct the following configuration options:
+<description>Is there a mission-critical reason for users to upload files via FTP? If not,
+edit the vsftpd configuration file to add or correct the following configuration options.
<pre>write_enable=NO</pre>
If FTP uploads are necessary, follow the guidance in the remainder of this section to secure these transactions
as much as possible.</description>
@@ -196,7 +195,7 @@ these users from filling a disk used by other services.</rationale>
blocks access to the ports used by the web server.
<iptables-desc-macro allow="true" proto="tcp" port="21" />
Edit the file <tt>/etc/sysconfig/iptables-config</tt>. Ensure that the space-separated list of modules contains
-the FTP connection tracking module:
+the FTP connection tracking module.
<pre>IPTABLES_MODULES="ip_conntrack_ftp"</pre></description>
<rationale>These settings configure iptables to allow connections to an FTP server. The first line allows initial connections
to the FTP server port.
--
1.7.1