FTP servers must be configured to prevent access to the system drive.

From Windows Server 2016 Security Technical Implementation Guide

Associated with: CCI-000366

SV-87957r1_rule FTP servers must be configured to prevent access to the system drive.

Vulnerability discussion

The FTP service allows remote users to access shared files and directories that could provide access to system resources and compromise the system, especially if the user can gain access to the root directory of the boot drive.

Check content

If FTP is not installed on the system, this is NA. Open "Internet Information Services (IIS) Manager". Select "Sites" under the server name. For any sites with a Binding that lists FTP, right-click the site and select "Explore". If the site is not defined to a specific folder for shared FTP resources, this is a finding. If the site includes any system areas such as root of the drive, Program Files, or Windows directories, this is a finding.

Fix text

Configure the FTP sites to allow access only to specific FTP shared resources. Do not allow access to other areas of the system.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.