Unrestricted FTP Access Should Not Be Allowed
More Info:
No security group should allow unrestricted inbound access to TCP ports 20 and 21 (FTP).Risk Level
MediumAddress
SecurityCompliance Standards
HITRUST, AWSWAF, GDPR, SOC2, NISTCSF, PCIDSS, FedRAMPTriage and Remediation
Remediation
Using Console
Using Console
To remediate the unrestricted FTP access issue in AWS, follow these steps:
- Log in to the AWS Management Console.
- Navigate to the EC2 dashboard.
- Select the EC2 instance(s) that have unrestricted FTP access.
- Click on the “Security Groups” tab at the bottom of the page.
- Identify the security group that is associated with the instance(s) and click on it.
- Click on the “Inbound Rules” tab.
- Locate the rule that allows unrestricted FTP access (port 21) and select it.
- Click on the “Delete” button to remove the rule.
- Click on the “Save” button to apply the changes.
Using CLI
Using CLI
To remediate the unrestricted FTP access issue in AWS using AWS CLI, follow these steps:Note: Replace Note: Replace
- Open the AWS CLI on your local machine.
- Run the following command to list all the security groups in your AWS account:
- Identify the security group that has unrestricted FTP access.
- Run the following command to remove the unrestricted FTP access from the identified security group:
<security-group-id> with the actual ID of the security group that needs to be updated.- Verify that the FTP access has been removed by running the following command:
<security-group-id> with the actual ID of the security group that was updated.- Repeat the above steps for all the security groups in your AWS account to ensure that unrestricted FTP access is not allowed in any of them.
Using Python
Using Python
To remediate unrestricted FTP access in AWS, you can use the following steps in Python:Step 1: Identify the Security Group with unrestricted FTP accessThis code will list all the security groups that have unrestricted FTP access.Step 2: Update the Security Group to restrict FTP accessThis code will restrict FTP access to the specified security group.Step 3: Verify that FTP access is restrictedThis code will verify that FTP access is restricted by attempting to connect to the FTP server. If the connection fails, it means that FTP access is restricted.