{"description": "Add or correct the following configuration options within the <tt>vsftpd</tt>\nconfiguration file, located at <tt>/etc/vsftpd/vsftpd.conf</tt>:\n<pre>xferlog_enable=YES\nxferlog_std_format=NO\nlog_ftp_protocol=YES</pre>", "rationale": "To trace malicious activity facilitated by the FTP service, it must be configured to ensure that all commands sent to\nthe FTP server are logged using the verbose vsftpd log\nformat. The default vsftpd log file is <tt>/var/log/vsftpd.log</tt>.", "severity": "unknown", "references": {}, "control_references": {}, "components": [], "identifiers": {}, "ocil_clause": "xferlog_enable is missing, or is not set to yes", "ocil": "Find if logging is applied to the FTP daemon.\n<br /><br />\nProcedures:\n<br /><br />\nIf vsftpd is started by xinetd the following command will indicate the xinetd.d startup file:\n<pre>$ grep vsftpd /etc/xinetd.d/*</pre>\n<pre>$ grep server_args <i>vsftpd xinetd.d startup file</i></pre>\nThis will indicate the vsftpd config file used when starting through xinetd.\nIf the <i>server_args</i> line is missing or does not include the vsftpd configuration file, then the default config file (/etc/vsftpd/vsftpd.conf) is used.\n<pre>$ sudo grep xferlog_enable <i>vsftpd config file</i></pre>", "oval_external_content": null, "fixtext": "", "checktext": "", "vuldiscussion": "", "srg_requirement": "", "warnings": [{"general": "If verbose logging to <tt>vsftpd.log</tt> is done, sparse logging of\ndownloads to <tt>/var/log/xferlog</tt> will not also occur. However,\nthe information about what files were downloaded is included in the\ninformation logged to <tt>vsftpd.log</tt>."}], "conflicts": [], "requires": [], "policy_specific_content": {}, "platform": null, "platforms": [], "sce_metadata": {}, "inherited_platforms": [], "cpe_platform_names": [], "inherited_cpe_platform_names": [], "bash_conditional": null, "fixes": {}, "title": "Enable Logging of All FTP Transactions", "definition_location": "/aptdata/openscap/scap-security-guide/linux_os/guide/services/ftp/ftp_configure_vsftpd/ftp_log_transactions/rule.yml", "template": null}