FTP servers must be configured to prevent anonymous logons.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-1120	WN12-GE-000026	SV-52106r1_rule	ECSC-1	Medium

Description
The FTP (File Transfer Protocol) service allows remote users to access shared files and directories. Allowing anonymous FTP connections makes user auditing difficult. Using accounts that have administrator privileges to log on to FTP risks that the userid and password will be captured on the network and give administrator access to an unauthorized user.

STIG	Date
Windows Server 2012 / 2012 R2 Member Server Security Technical Implementation Guide	2014-04-02

Details

Check Text ( C-46923r1_chk )
If FTP is not installed on the system, this is NA. Open a "Command Prompt". Attempt to log on as the user "anonymous" with the following commands: C:\>ftp localhost (Connected to "servername". 220 Microsoft FTP Service) User: anonymous (331 Anonymous access allowed, send identity (e-mail name) as password.) Password: password (230 User logged in.) ftp> If the command response indicates that an anonymous FTP login was permitted, this is a finding.

Check Text ( C-46923r1_chk )

If FTP is not installed on the system, this is NA.

Open a "Command Prompt".
Attempt to log on as the user "anonymous" with the following commands:

C:\>ftp localhost
(Connected to "servername".
220 Microsoft FTP Service)

User: anonymous
(331 Anonymous access allowed, send identity (e-mail name) as password.)

Password: password
(230 User logged in.)
ftp>

If the command response indicates that an anonymous FTP login was permitted, this is a finding.

Fix Text (F-45131r1_fix)
Configure the system to prevent an installed FTP service from allowing anonymous logons.