Installed FTP server will not be configured to allow access to the system drive.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-1121	5.005	SV-32252r1_rule	ECCD-1 ECCD-2	High

Description
This is a Category 1 finding because the FTP service allows remote users to access shared files and directories which could provide access to system resources and compromise the system, especially if the user can gain access to the root directory of the boot drive.

STIG	Date
Windows Server 2008 R2 Domain Controller Security Technical Implementation Guide	2012-09-05

Details

Check Text ( C-32939r1_chk )
In the “Command Prompt” window, enter the following command, log on using an authenticated FTP account, and attempt to access the root of the boot drive: X:\>ftp 127.0.0.1 (Connected to "servername". 220 "servername" Microsoft FTP Service (Version 2.0).) User: ftpuser (331 Password required for ftpuser.) Password: password (230 User ftpuser logged in.) ftp> dir / If the FTP session indicates access to operating system files like “PAGEFILE.SYS” or “NTLDR,” then this is a finding.

Check Text ( C-32939r1_chk )

In the “Command Prompt” window, enter the following command, log on using an authenticated FTP account, and attempt to access the root of the boot drive:

X:\>ftp 127.0.0.1
(Connected to "servername".
220 "servername" Microsoft FTP Service (Version 2.0).)

User: ftpuser
(331 Password required for ftpuser.)

Password: password
(230 User ftpuser logged in.)

ftp> dir /

If the FTP session indicates access to operating system files like “PAGEFILE.SYS” or “NTLDR,” then this is a finding.

Fix Text (F-5814r1_fix)
Configure the system to prevent an FTP Service from allowing access to the system drive.