Installed FTP server is configured to allow prohibited logins.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-1120	5.004	SV-29493r1_rule	ECSC-1	Medium

Description
The FTP (File Transfer Protocol) service allows remote users to access shared files and directories. Allowing anonymous FTP makes user auditing difficult. Using accounts that have administrator privileges to log on to FTP risks that the user id and password will be captured on the network, and give administrator access to an unauthorized user.

STIG	Date
Windows 2008 Domain Controller Security Technical Implementation Guide	2015-03-09

Details

Check Text ( C-515r1_chk )
In the “Command Prompt” window, enter the following command, and attempt to logon as the user “anonymous:” C:\>ftp 127.0.0.1 (Connected to ftru014538.ncr.disa.mil. 220 ftru014538 Microsoft FTP Service (Version 2.0).) User: anonymous (331 Anonymous access allowed, send identity (e-mail name) as password.) Password: password (230 Anonymous user logged in.) ftp> If the command response indicates that an anonymous FTP login was permitted, then this is a finding. Severity Override: If accounts with administrator privileges are used to access FTP, then this becomes a Category I finding.

Check Text ( C-515r1_chk )

In the “Command Prompt” window, enter the following command, and attempt to logon as the user “anonymous:”

C:\>ftp 127.0.0.1
(Connected to ftru014538.ncr.disa.mil.
220 ftru014538 Microsoft FTP Service (Version 2.0).)

User: anonymous
(331 Anonymous access allowed, send identity (e-mail name) as password.)

Password: password
(230 Anonymous user logged in.)
ftp>

If the command response indicates that an anonymous FTP login was permitted, then this is a finding.

Severity Override: If accounts with administrator privileges are used to access FTP, then this becomes a Category I finding.

Fix Text (F-5813r1_fix)
Configure the system to prevent an installed FTP service from allowing prohibited logons.