Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
m_k_user
Participant
Jump to solution

FTP service accepting unencrypted credentials

Hi team
Hi community
I have Security Gateway with multiple FTP service ports opened. Ports are high numbered >33000
Nmap says "Check Point Firewall - 1 ftpd".
The vulnerability scanner says "Remote Management Service Accepting Unencrypted Credentials Detected (FTP)".
Please, help. Could it be a false positive? Like credentials are realy encrypted.
Why so many (about 14) ftp ports are opened?
Should I configure ftpd via expert mode?

0 Kudos
1 Solution

Accepted Solutions
HeikoAnkenbrand
Champion Champion
Champion

By default, no ftp ports are open on the Check Point firewall.

1) Maybe you have NAT rules to internal FTP servers. I would check the NAT rules.
     In this case I would use SFTP or SSH, then the traffic is encrypted. 

2) It may also be that open ports are recognised incorrectly by NMAP. It depends on how you perform the NMAP scan.

➜ CCSM Elite, CCME, CCTE ➜ www.checkpoint.tips

View solution in original post

0 Kudos
5 Replies
HeikoAnkenbrand
Champion Champion
Champion

By default, no ftp ports are open on the Check Point firewall.

1) Maybe you have NAT rules to internal FTP servers. I would check the NAT rules.
     In this case I would use SFTP or SSH, then the traffic is encrypted. 

2) It may also be that open ports are recognised incorrectly by NMAP. It depends on how you perform the NMAP scan.

➜ CCSM Elite, CCME, CCTE ➜ www.checkpoint.tips
0 Kudos
4mon
Participant

Hi, 
I think this vulnerability should be investigated.

Check in expert mode which service listening on this ports:
for example on tcp 37517:
lsof -i TCP:37517

if your output look similar like this:
in.aftpd 4993 admin 0u IPv4 49264 TCP *:37517 (LISTEN)

then you should implement solution described here (upgrade a hotfix and comment 21 port in file):
https://support.checkpoint.com/results/sk/sk180505

you can also check on which ports n.aftpd listened:
ps aux | grep in.aftpd

0 Kudos
Lesley
Leader Leader
Leader

Why it needs to be investigated if I may ask? Everyone knows you should not use FTP and instead use an encrypted alternative like FTPS or SSH. Also the SK is pretty clear to me. 

-------
If you like this post please give a thumbs up(kudo)! 🙂
0 Kudos
4mon
Participant

To prevent?
If some service works and listening on multilpe ports when we don't using them then is better leave it works or turn off?

0 Kudos
Chris_Atkinson
Employee Employee
Employee

The way the SK is written it shouldn't be an issue with the appropriate JHF installed.

If you are seeing different then you should take it with TAC for investigation obviously.

CCSM R77/R80/ELITE
0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events