Legacy plaintext services
high external
What it inspects
Opens a plain TCP connection to ports 21 (FTP), 23 (Telnet), 69 (TFTP), 512 (rexec), 513 (rlogin) and 514 (rsh) on the scanned host and records whether it connects. It sends nothing and never logs in. Any port that connects is a FAIL, whatever software answers. TFTP normally uses UDP, which this TCP-only check cannot see, and 514 is also used by TCP syslog. This is an active check: it runs only after you have verified ownership of the host.
Why it matters
These protocols predate encryption: credentials and file contents cross the network readable by anyone on the path, and the r-services trust the connecting address instead of a key. They are old, rarely patched, and a favourite of automated password-guessing. SSH and SFTP do the same jobs with encryption, so there is almost never a reason to leave them open to the internet.
How to verify
# only against hosts you own
nmap -Pn -p 21,23,69,512-514 example.com
# Every port should be reported closed or filtered (this is a TCP scan; TFTP is normally UDP, so also look on the server itself):
ss -tlnup | grep -E ':(21|23|69|512|513|514)[[:space:]]'
How to fix
Stop and disable the listening service (use SSH or SFTP instead), or, where it must stay, limit it to the addresses that need it at the firewall.
Find what is listening and switch it off needs your judgement
Any distro
# Plaintext services send passwords and data readable by anyone on the network path. Find out what is answering, then decide.
# The last column names the process:
# ss -tlnp '( sport = :21 or sport = :23 or sport = :69 or sport = :512 or sport = :513 or sport = :514 )'
# Find the package and the unit that own it (Debian: dpkg -S, RHEL family: rpm -qf):
# dpkg -S "$(readlink -f /proc/<pid>/exe)"
# rpm -qf "$(readlink -f /proc/<pid>/exe)"
# systemctl list-units --type=service,socket | grep -iE 'ftp|telnet|rsh|rlogin|rexec|tftp'
#
# Telnet (23), rexec (512), rlogin (513), rsh (514): nothing legitimate needs these; SSH replaces all of them.
# Typical units: telnet.socket, rsh.socket, rlogin.socket, rexec.socket. If started by inetd or xinetd instead, disable the
# entry in /etc/inetd.conf or /etc/xinetd.d/ and restart that daemon (it may serve other services, so do not just stop it).
# FTP (21): a data transfer service people may still depend on. Typical units: vsftpd, proftpd, pure-ftpd.
# Replace it with SFTP, which your existing SSH server already provides (nothing to install: sftp user@example.com),
# or with FTPS if clients need the FTP protocol. Tell the people who use it BEFORE you switch it off.
# TFTP (69): used for network booting and device configs. Typical units: tftpd-hpa (Debian/Ubuntu), tftp.socket (RHEL family).
# TFTP normally uses UDP, which this TCP check cannot see; a finding on 69 means something accepts TCP connections there.
# 514 may also be rsyslog receiving logs over TCP, which is not rsh. If so, keep it but firewall it to your log sources (next step).
#
# When you have decided, stop it now and keep it off after reboots (replace the unit name):
# systemctl disable --now telnet.socket
# Or remove the package so it cannot return (names differ: telnetd, inetutils-telnetd, telnet-server, rsh-server, vsftpd, tftpd-hpa, tftp-server):
# apt-get remove <package> (Debian/Ubuntu)
# dnf remove <package> (RHEL family)
# Confirm nothing listens any more, then re-test from outside (only against hosts you own):
# ss -tlnp '( sport = :23 )'
# nmap -Pn -p 21,23,69,512-514 example.com
- Restrict a service that must stay
1 more step in the Fix Pack. See pricing