FTP service accepting unencrypted credentials

[m_k_user]

Hi team
Hi community
I have Security Gateway with multiple FTP service ports opened. Ports are high numbered >33000
Nmap says "Check Point Firewall - 1 ftpd".
The vulnerability scanner says "Remote Management Service Accepting Unencrypted Credentials Detected (FTP)".
Please, help. Could it be a false positive? Like credentials are realy encrypted.
Why so many (about 14) ftp ports are opened?
Should I configure ftpd via expert mode?

[HeikoAnkenbrand · Accepted solution]

By default, no ftp ports are open on the Check Point firewall.

1) Maybe you have NAT rules to internal FTP servers. I would check the NAT rules.
     In this case I would use SFTP or SSH, then the traffic is encrypted. 

2) It may also be that open ports are recognised incorrectly by NMAP. It depends on how you perform the NMAP scan.

[4mon]

Hi, 
I think this vulnerability should be investigated.

Check in expert mode which service listening on this ports:
for example on tcp 37517:
lsof -i TCP:37517

if your output look similar like this:
in.aftpd 4993 admin 0u IPv4 49264 TCP *:37517 (LISTEN)

then you should implement solution described here (upgrade a hotfix and comment 21 port in file):
https://support.checkpoint.com/results/sk/sk180505

you can also check on which ports n.aftpd listened:
ps aux | grep in.aftpd

[Lesley]

Why it needs to be investigated if I may ask? Everyone knows you should not use FTP and instead use an encrypted alternative like FTPS or SSH. Also the SK is pretty clear to me. 

[4mon]

To prevent?
If some service works and listening on multilpe ports when we don't using them then is better leave it works or turn off?

[Chris_Atkinson]

The way the SK is written it shouldn't be an issue with the appropriate JHF installed.

If you are seeing different then you should take it with TAC for investigation obviously.

[tavi0906]

Our gateway running on R81.20  with JHF 89 but still the output of ps aux | grep -i ftp showing it is listening on port 21.

what we can do to resolve this?

[Chris_Atkinson]

Which version is the MGMT?

If the SK has been followed and the issue persists please contact TAC to investigate.