File Transfer Protocol (FTP) servers must be configured to prevent access to the system drive.

From Windows 2008 Member Server Security Technical Implementation Guide

Part of FTP System File Access

Associated with: CCI-000366

SV-29497r2_rule File Transfer Protocol (FTP) servers must be configured to prevent access to the system drive.

Vulnerability discussion

The FTP service allows remote users to access shared files and directories. Access outside of the specific directories of shared data could provide access to system resources and compromise the system.

Check content

If FTP is not installed on the system, this is NA. Determine the IP address and port number assigned to FTP sites from documentation or configuration. If Microsoft FTP is used, open "Internet Information Services (IIS) 6.0 Manager". Select "FTP Sites" under the server name. View the IP address and port information for any sites listed. The standard port for FTP is 21, however this may be changed. Open a "Command Prompt". Access the FTP site and review accessible directories with the following commands: Note: Returned results may vary depending on the FTP server software. C:\> "ftp" ftp> "Open IP Address Port" (Substituting [IP Address] and [Port] with the information previously identified. If no IP Address was listed in the Binding, attempt using "localhost".) (Connected to IP Address 220 Microsoft FTP Service) User (IP Address): "FTP User" (Substituting [FTP User] with an account identified that is allowed access. If it was determined that anonymous access was allowed to the site [see V-1120], also review access using "anonymous".) (331 Password required) Password: "Password" (Substituting [Password] with password for the account attempting access.) (230 User ftpuser logged in.) ftp> "Dir" If the FTP session indicates access to areas of the system other than the specific folder for FTP data, such as the root of the drive, Program Files or Windows directories, this is a finding.

Fix text

Configure the system to only allow FTP access to specific folders containing the data to be available through the service.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.

Powered by sagemincer