Unrestricted FTP Access Should Not Be Allowed

More Info:

No security group should allow unrestricted inbound access to TCP ports 20 and 21 (FTP).

Risk Level

Medium

Address

Security

Compliance Standards

• APRA CPS 234 (Australia)
• AWS Startup Security Baseline
• AWS Well Architected Framework
• BSI C5 (Germany)
• Brazil LGPD
• CCPA / CPRA (California)
• CIS Critical Security Controls v8
• CMMC 2.0
• CSA Cloud Controls Matrix v4
• DPDPA
• Digital Operational Resilience Act (EU)
• FedRAMP
• GDPR
• HITRUST CSF
• ISO/IEC 27017
• ISO/IEC 27018
• ISO/IEC 27701
• KSA PDPL
• MAS Technology Risk Management (Singapore)
• MITRE ATT&CK (Cloud)
• NIS2 Directive
• NIST CSF
• NIST SP 800-171
• NYDFS 23 NYCRR 500
• PCI
• Reserve Bank of India (RBI) Cyber Security Framework
• Reserve Bank of India (RBI) Master Direction – Information Technology Framework
• SOC2
• SWIFT Customer Security Controls Framework
• Sarbanes-Oxley IT General Controls
• UK NCSC Cyber Assessment Framework

Triage and Remediation

Remediation

Remediation

Using Console

To remediate the unrestricted FTP access issue in AWS, follow these steps:

1. Log in to the AWS Management Console.
2. Navigate to the EC2 dashboard.
3. Select the EC2 instance(s) that have unrestricted FTP access.
4. Click on the "Security Groups" tab at the bottom of the page.
5. Identify the security group that is associated with the instance(s) and click on it.
6. Click on the "Inbound Rules" tab.
7. Locate the rule that allows unrestricted FTP access (port 21) and select it.
8. Click on the "Delete" button to remove the rule.
9. Click on the "Save" button to apply the changes.

Once you have completed these steps, the unrestricted FTP access issue will be remediated for the selected EC2 instance(s).

Using CLI

To remediate the unrestricted FTP access issue in AWS using AWS CLI, follow these steps:

1. Open the AWS CLI on your local machine.

2. Run the following command to list all the security groups in your AWS account:

aws ec2 describe-security-groups

3. Identify the security group that has unrestricted FTP access.

4. Run the following command to remove the unrestricted FTP access from the identified security group:

aws ec2 revoke-security-group-ingress --group-id <security-group-id> --protocol tcp --port 21 --cidr 0.0.0.0/0

Note: Replace <security-group-id> with the actual ID of the security group that needs to be updated.

5. Verify that the FTP access has been removed by running the following command:

aws ec2 describe-security-groups --group-ids <security-group-id>

Note: Replace <security-group-id> with the actual ID of the security group that was updated.

6. Repeat the above steps for all the security groups in your AWS account to ensure that unrestricted FTP access is not allowed in any of them.

By following the above steps, you can remediate the unrestricted FTP access issue in AWS using AWS CLI.

Using Python

To remediate unrestricted FTP access in AWS, you can use the following steps in Python:

Step 1: Identify the Security Group with unrestricted FTP access

import boto3
aws_account_id = 'YOUR_AWS_ACCOUNT_ID'
region = 'YOUR_AWS_REGION'
ec2 = boto3.client('ec2', region_name=region)
response = ec2.describe_security_groups()
for sg in response['SecurityGroups']:
    for ip_permission in sg['IpPermissions']:
        if 'FromPort' in ip_permission and ip_permission['FromPort'] == 21 and 'IpRanges' in ip_permission:
            for ip_range in ip_permission['IpRanges']:
                if ip_range['CidrIp'] == '0.0.0.0/0':
                    print('Security Group ID: ', sg['GroupId'])

This code will list all the security groups that have unrestricted FTP access.

Step 2: Update the Security Group to restrict FTP access

import boto3
aws_account_id = 'YOUR_AWS_ACCOUNT_ID'
region = 'YOUR_AWS_REGION'
ec2 = boto3.client('ec2', region_name=region)
security_group_id = 'YOUR_SECURITY_GROUP_ID'
response = ec2.revoke_security_group_ingress(
    GroupId=security_group_id,
    IpPermissions=[
        {
            'IpProtocol': 'tcp',
            'FromPort': 21,
            'ToPort': 21,
            'IpRanges': [
                {
                    'CidrIp': '0.0.0.0/0'
                },
            ],
        },
    ],
)

This code will restrict FTP access to the specified security group.

Step 3: Verify that FTP access is restricted

import socket
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.settimeout(5)
try:
    s.connect(('FTP_SERVER_IP', 21))
    print('FTP access is still unrestricted')
except:
    print('FTP access is restricted')
s.close()

This code will verify that FTP access is restricted by attempting to connect to the FTP server. If the connection fails, it means that FTP access is restricted.

Using Terraform

resource "aws_security_group" "FTP_SG" {
  name        = "ftp-sg"
  description = "Security group without unrestricted FTP access"
  vpc_id      = AWS_VPC_ID  # replace with your VPC ID, e.g. aws_vpc.main.id

  # Example: allow SSH from anywhere (still allowed by policy, adjust as needed)
  ingress {
    description = "SSH from anywhere"
    from_port   = 22
    to_port     = 22
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
    ipv6_cidr_blocks = ["::/0"]
  }

  # Example FIX: FTP control (21) ONLY from a restricted CIDR, not 0.0.0.0/0 or ::/0
  ingress {
    description = "FTP control from office network"
    from_port   = 21
    to_port     = 21
    protocol    = "tcp"
    cidr_blocks = ["OFFICE_IPV4_CIDR"]      # e.g. "203.0.113.0/24"
    # No "::/0" here; add only specific IPv6 ranges if required
    ipv6_cidr_blocks = ["OFFICE_IPV6_CIDR"] # e.g. "2001:db8:1234::/64"
  }

  # Example FIX: FTP data (20) ONLY from the same restricted ranges
  ingress {
    description = "FTP data from office network"
    from_port   = 20
    to_port     = 20
    protocol    = "tcp"
    cidr_blocks = ["OFFICE_IPV4_CIDR"]
    ipv6_cidr_blocks = ["OFFICE_IPV6_CIDR"]
  }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
    ipv6_cidr_blocks = ["::/0"]
  }

  tags = {
    Name = "ftp-sg"
  }
}

Replace:

• AWS_VPC_ID with your VPC ID.
• OFFICE_IPV4_CIDR / OFFICE_IPV6_CIDR with the specific networks that should be allowed, or replace cidr_blocks/ipv6_cidr_blocks with a security_groups/source_security_group_id–based rule if only other SGs may access FTP.

This change removes any ingress rules that allow TCP ports 20 or 21 from 0.0.0.0/0 or ::/0. It updates the security group in place (no replacement of the SG itself), but may disrupt existing FTP traffic that relied on unrestricted access.

For verification, terraform plan should show either:

• Removal of existing ingress rules on ports 20 and 21 that used 0.0.0.0/0 and/or ::/0, or
• Modification of those rules so the cidr_blocks / ipv6_cidr_blocks no longer include 0.0.0.0/0 or ::/0.

Additional Reading:

• https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html#AddRemoveRules