​
More Info:

No security group should allow unrestricted inbound access to TCP ports 20 and 21 (FTP).

​
Risk Level

Medium

​
Address

Security

​
Compliance Standards

HITRUST, AWSWAF, GDPR, SOC2, NISTCSF, PCIDSS, FedRAMP

​
Remediation

​
Using Console

To remediate the unrestricted FTP access issue in AWS, follow these steps:

  1. Log in to the AWS Management Console.
  2. Navigate to the EC2 dashboard.
  3. Select the EC2 instance(s) that have unrestricted FTP access.
  4. Click on the “Security Groups” tab at the bottom of the page.
  5. Identify the security group that is associated with the instance(s) and click on it.
  6. Click on the “Inbound Rules” tab.
  7. Locate the rule that allows unrestricted FTP access (port 21) and select it.
  8. Click on the “Delete” button to remove the rule.
  9. Click on the “Save” button to apply the changes.

Once you have completed these steps, the unrestricted FTP access issue will be remediated for the selected EC2 instance(s).

​
Using CLI

To remediate the unrestricted FTP access issue in AWS using AWS CLI, follow these steps:

  1. Open the AWS CLI on your local machine.

  2. Run the following command to list all the security groups in your AWS account:

aws ec2 describe-security-groups

  1. Identify the security group that has unrestricted FTP access.

  2. Run the following command to remove the unrestricted FTP access from the identified security group:

aws ec2 revoke-security-group-ingress --group-id <security-group-id> --protocol tcp --port 21 --cidr 0.0.0.0/0

Note: Replace <security-group-id> with the actual ID of the security group that needs to be updated.

  1. Verify that the FTP access has been removed by running the following command:
aws ec2 describe-security-groups --group-ids <security-group-id>

Note: Replace <security-group-id> with the actual ID of the security group that was updated.

  1. Repeat the above steps for all the security groups in your AWS account to ensure that unrestricted FTP access is not allowed in any of them.

By following the above steps, you can remediate the unrestricted FTP access issue in AWS using AWS CLI.

​
Using Python

To remediate unrestricted FTP access in AWS, you can use the following steps in Python:

Step 1: Identify the Security Group with unrestricted FTP access

import boto3
aws_account_id = 'YOUR_AWS_ACCOUNT_ID'
region = 'YOUR_AWS_REGION'
ec2 = boto3.client('ec2', region_name=region)
response = ec2.describe_security_groups()
for sg in response['SecurityGroups']:
    for ip_permission in sg['IpPermissions']:
        if 'FromPort' in ip_permission and ip_permission['FromPort'] == 21 and 'IpRanges' in ip_permission:
            for ip_range in ip_permission['IpRanges']:
                if ip_range['CidrIp'] == '0.0.0.0/0':
                    print('Security Group ID: ', sg['GroupId'])

This code will list all the security groups that have unrestricted FTP access.

Step 2: Update the Security Group to restrict FTP access

import boto3
aws_account_id = 'YOUR_AWS_ACCOUNT_ID'
region = 'YOUR_AWS_REGION'
ec2 = boto3.client('ec2', region_name=region)
security_group_id = 'YOUR_SECURITY_GROUP_ID'
response = ec2.revoke_security_group_ingress(
    GroupId=security_group_id,
    IpPermissions=[
        {
            'IpProtocol': 'tcp',
            'FromPort': 21,
            'ToPort': 21,
            'IpRanges': [
                {
                    'CidrIp': '0.0.0.0/0'
                },
            ],
        },
    ],
)

This code will restrict FTP access to the specified security group.

Step 3: Verify that FTP access is restricted

import socket
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.settimeout(5)
try:
    s.connect(('FTP_SERVER_IP', 21))
    print('FTP access is still unrestricted')
except:
    print('FTP access is restricted')
s.close()

This code will verify that FTP access is restricted by attempting to connect to the FTP server. If the connection fails, it means that FTP access is restricted.

​
Additional Reading: