Remote Management Service Accepting Unencrypted Credentials Detected (FTP) on port 21

Products

Workload Automation Agent Autosys Workload Automation ESP dSeries Workload Automation ESP dSeries Workload Automation - Scheduler (dSeries) ESP dSeries Workload Automation - System Agent (dSeries) ESP dSeries Workload Automation - Business Agents (dSeries)

Issue/Introduction

A Qualys (or similar security) scan reports the vulnerability QID-48169: Remote Management Service Accepting Unencrypted Credentials Detected (FTP) on an AutoSys iDash or Workload Automation server.

Specifically, the scan identifies that the server is listening on TCP Port 21. Analysis of the system shows that the Workload Automation System Agent (Java process) is the service holding the port open, even if no FTP jobs are currently defined or in use.

Example netstat output:

Environment

Product: Workload Automation Agent
Component: Workload Automation System Agent (All versions)
Platform: Linux / UNIX / Windows

Cause

The Workload Automation System Agent includes a built-in FTP server plugin that is often enabled by default during installation or via the agentparm.txt configuration. When the FTP plugin is active (plugins.start_internal_N=ftp), the agent functions as an FTP server and listens on the default FTP port (21). Because standard FTP transmits credentials in clear text, security scanners flag this as a vulnerability.

Resolution

To resolve this vulnerability finding, you must disable the internal FTP server component within the agent configuration.

Navigate to the System Agent installation directory.
Open the agentparm.txt file in a text editor.
Locate the parameter ftp.noserver. If it does not exist, add it to the bottom of the file.
Set the value to true:
text
```
ftp.noserver=true
```
Save the file.
Restart the System Agent service to apply the change.

Impact of this change:

Agent as Server: The agent will no longer listen on port 21 and will not accept incoming FTP connections. This satisfies the security requirement.
Agent as Client: The agent can still perform FTP, SFTP, or SCP transfers to remote servers. Setting ftp.noserver=true only disables the inbound server capability, not the outbound client capability.

Verification:

After the restart, run the following command to verify port 21 is no longer in use by the agent: Linux:

Windows:

If you require the FTP server functionality but need to secure it, you must configure the agent for FTP over SSL (FTPS). Refer to the product documentation for Configuring SSL FTP to implement encryption rather than disabling the service.