topic Re: FTP service accepting unencrypted credentials in Firewall and Security Management

FTP service accepting unencrypted credentials

m_k_user — Fri, 02 Feb 2024 07:09:54 GMT

Hi team
Hi community
I have Security Gateway with multiple FTP service ports opened. Ports are high numbered >33000
Nmap says "Check Point Firewall - 1 ftpd".
The vulnerability scanner says "Remote Management Service Accepting Unencrypted Credentials Detected (FTP)".
Please, help. Could it be a false positive? Like credentials are realy encrypted.
Why so many (about 14) ftp ports are opened?
Should I configure ftpd via expert mode?

Re: FTP service accepting unencrypted credentials

HeikoAnkenbrand — Fri, 02 Feb 2024 14:48:30 GMT

By default, no ftp ports are open on the Check Point firewall.

1) Maybe you have NAT rules to internal FTP servers. I would check the NAT rules.
In this case I would use SFTP or SSH, then the traffic is encrypted.

2) It may also be that open ports are recognised incorrectly by NMAP. It depends on how you perform the NMAP scan.

Re: FTP service accepting unencrypted credentials

4mon — Wed, 24 Jul 2024 12:50:42 GMT

Hi,
I think this vulnerability should be investigated.

Check in expert mode which service listening on this ports:
for example on tcp 37517:
lsof -i TCP:37517

if your output look similar like this:
in.aftpd 4993 admin 0u IPv4 49264 TCP *:37517 (LISTEN)

then you should implement solution described here (upgrade a hotfix and comment 21 port in file):
https://support.checkpoint.com/results/sk/sk180505

you can also check on which ports n.aftpd listened:
ps aux | grep in.aftpd

Re: FTP service accepting unencrypted credentials

Lesley — Wed, 24 Jul 2024 19:39:19 GMT

Why it needs to be investigated if I may ask? Everyone knows you should not use FTP and instead use an encrypted alternative like FTPS or SSH. Also the SK is pretty clear to me.

Re: FTP service accepting unencrypted credentials

4mon — Thu, 25 Jul 2024 10:28:04 GMT

To prevent?
If some service works and listening on multilpe ports when we don't using them then is better leave it works or turn off?

Re: FTP service accepting unencrypted credentials

Chris_Atkinson — Thu, 25 Jul 2024 10:46:46 GMT

The way the SK is written it shouldn't be an issue with the appropriate JHF installed.

If you are seeing different then you should take it with TAC for investigation obviously.

Re: FTP service accepting unencrypted credentials

tavi0906 — Fri, 14 Feb 2025 07:45:02 GMT

Our gateway running on R81.20 with JHF 89 but still the output of ps aux | grep -i ftp showing it is listening on port 21.

what we can do to resolve this?

Re: FTP service accepting unencrypted credentials

Chris_Atkinson — Fri, 14 Feb 2025 08:58:21 GMT

Which version is the MGMT?

If the SK has been followed and the issue persists please contact TAC to investigate.