UCF STIG Viewer Logo

FTP servers must be configured to prevent anonymous logons.


Overview

Finding ID Version Rule ID IA Controls Severity
V-1120 WN12-GE-000026 SV-52106r1_rule ECSC-1 Medium
Description
The FTP (File Transfer Protocol) service allows remote users to access shared files and directories. Allowing anonymous FTP connections makes user auditing difficult. Using accounts that have administrator privileges to log on to FTP risks that the userid and password will be captured on the network and give administrator access to an unauthorized user.
STIG Date
Windows Server 2012 Domain Controller Security Technical Implementation Guide 2014-01-07

Details

Check Text ( C-46923r1_chk )
If FTP is not installed on the system, this is NA.

Open a "Command Prompt".
Attempt to log on as the user "anonymous" with the following commands:

C:\>ftp localhost
(Connected to "servername".
220 Microsoft FTP Service)

User: anonymous
(331 Anonymous access allowed, send identity (e-mail name) as password.)

Password: password
(230 User logged in.)
ftp>

If the command response indicates that an anonymous FTP login was permitted, this is a finding.
Fix Text (F-45131r1_fix)
Configure the system to prevent an installed FTP service from allowing anonymous logons.