Skip to main content

Unrestricted FTP Access To Port 20

More Info:​

Ensure that Microsoft Azure network security groups (NSGs) do not allow unrestricted access on TCP ports 20 and 21 in order to protect against attackers that use brute force methods to gain access to Azure virtual machines associated with these NSGs. TCP ports 20 and 21 are used for data transfer and communication by the File Transfer Protocol (FTP) client-server applications.

Risk Level​

High

Address​

Security

Compliance Standards​

  • APRA CPS 234 (Australia)
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • FedRAMP
  • GDPR
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIS2 Directive
  • NIST CSF
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • PCI
  • SOC2
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • UK NCSC Cyber Assessment Framework

Triage and Remediation​

Remediation​

Using Console

To remediate unrestricted FTP access to Port 20 in Azure, follow these steps:

  1. Open the Azure portal and navigate to the Virtual Machine (VM) that has unrestricted FTP access to Port 20.

  2. Stop the VM by clicking on the "Stop" button at the top of the VM's overview page.

  3. Once the VM is stopped, click on the "Networking" tab in the left-hand menu.

  4. Click on the "Add inbound port rule" button.

  5. In the "Add inbound security rule" dialog, configure the following settings:

  • Name: A descriptive name for the new rule.
  • Priority: A number that determines the order in which rules are evaluated (lower numbers are evaluated first).
  • Source: The IP address range or subnet that should be allowed to access Port 20. If you want to restrict access to a specific IP address, enter that IP address in the "Source IP addresses/CIDR ranges" field.
  • Destination port ranges: Enter "20" to restrict access to Port 20.
  • Protocol: Select "TCP" from the dropdown menu.
  • Action: Select "Allow" from the dropdown menu.

  1. Click on the "Add" button to create the new inbound security rule.

  2. Start the VM by clicking on the "Start" button at the top of the VM's overview page.

By following these steps, you have remediated the unrestricted FTP access to Port 20 in Azure by restricting access to only the IP address range or subnet that should be allowed to access Port 20.

Using CLI

To remediate the unrestricted FTP access to port 20 misconfiguration in Azure using Azure CLI, you can follow the following steps:

  1. Open the Azure CLI and login to your Azure account using the command az login.

  2. Once you are logged in, run the following command to get the list of all the virtual machines in your Azure subscription:

    az vm list --query "[].{name:name, resourceGroup:resourceGroup}"

  3. Identify the virtual machine that has unrestricted FTP access to port 20 and note down its name and resource group.

  4. Run the following command to open port 20 for FTP traffic on the identified virtual machine:

    az vm open-port --port 20 --resource-group <resource-group-name> --name <vm-name> --priority 1001

    Note: Replace <resource-group-name> and <vm-name> with the actual names of the resource group and virtual machine that you have identified.

  5. Verify that the port 20 is now open for FTP traffic on the virtual machine by running the following command:

    az vm show --resource-group <resource-group-name> --name <vm-name> --query "networkProfile.networkInterfaces[].ipConfigurations[].openPorts"

    This command should return the list of all the open ports on the virtual machine, including port 20 for FTP traffic.

  6. Repeat the above steps for all the virtual machines in your Azure subscription that have unrestricted FTP access to port 20.

By following the above steps, you can remediate the unrestricted FTP access to port 20 misconfiguration in Azure using Azure CLI.

Using Python

To remediate the unrestricted FTP access to port 20 in Azure using Python, you can follow the below steps:

  1. Identify the Azure virtual machine(s) that have unrestricted FTP access to port 20.
  2. Use the Python SDK for Azure to create a network security group (NSG) for the virtual machine(s) that allows FTP access only from a specific IP address or range.
  3. Associate the NSG with the virtual machine(s) that have unrestricted FTP access to port 20.
  4. Verify that the NSG is working as expected by testing FTP access from a different IP address.

Here is an example Python code to create a network security group and associate it with a virtual machine in Azure:

from azure.mgmt.network import NetworkManagementClient
from azure.common.credentials import ServicePrincipalCredentials

# Set your Azure subscription ID, client ID, secret, and tenant ID
subscription_id = 'your_subscription_id'
client_id = 'your_client_id'
secret = 'your_secret'
tenant = 'your_tenant_id'

# Set the resource group and virtual machine name
resource_group_name = 'your_resource_group_name'
vm_name = 'your_virtual_machine_name'

# Set the IP address or range that is allowed to access FTP
ftp_ip_address = 'your_ftp_ip_address'

# Authenticate with Azure using a service principal
credentials = ServicePrincipalCredentials(
    client_id=client_id,
    secret=secret,
    tenant=tenant
)

# Create a network security group
network_client = NetworkManagementClient(credentials, subscription_id)
nsg_params = {
    'location': 'your_location',
    'security_rules': [
        {
            'name': 'FTP',
            'protocol': 'Tcp',
            'source_port_range': '*',
            'destination_port_range': '20',
            'source_address_prefix': ftp_ip_address,
            'destination_address_prefix': '*',
            'access': 'Allow',
            'priority': 100,
            'direction': 'Inbound'
        }
    ]
}
nsg = network_client.network_security_groups.create_or_update(
    resource_group_name,
    'FTP-NSG',
    nsg_params
)

# Associate the network security group with the virtual machine
vm = network_client.virtual_machines.get(
    resource_group_name,
    vm_name
)
vm.network_profile.network_interfaces[0].network_security_group = nsg
network_client.virtual_machines.create_or_update(
    resource_group_name,
    vm_name,
    vm
)

This code creates a network security group that allows FTP access only from the specified IP address or range, and associates it with the virtual machine. You can customize the code to meet your specific requirements.

Using Terraform
# Network Security Group (existing or new)
resource "azurerm_network_security_group" "nsg" {
  name                = "NSG_NAME"                # replace with your NSG name
  resource_group_name = "RESOURCE_GROUP_NAME"     # replace with your resource group
  location            = "AZURE_REGION"            # e.g. "eastus"
}

# Restrict FTP data/control ports so they are NOT open to all ("*")
# If you already have rules allowing ports 20 or 21 with source "*" or 0.0.0.0/0,
# replace those with this more restrictive rule or remove them entirely.

resource "azurerm_network_security_rule" "ftp_restricted" {
  name                        = "ftp-20-21-restricted"
  priority                    = 200                  # choose a priority that fits your NSG
  direction                   = "Inbound"
  access                      = "Allow"
  protocol                    = "Tcp"
  source_port_range           = "*"
  destination_port_ranges     = ["20", "21"]
  source_address_prefix       = "ALLOWED_FTP_SOURCE_CIDR"  # e.g. "203.0.113.0/24" or a trusted IP
  destination_address_prefix  = "*"

  resource_group_name         = azurerm_network_security_group.nsg.resource_group_name
  network_security_group_name = azurerm_network_security_group.nsg.name
}

Changing an existing azurerm_network_security_rule from source_address_prefix = "*" (or 0.0.0.0/0) to a restricted CIDR typically updates that rule in place; if the name or direction/priority change, Terraform will replace only the rule resource, not the NSG itself.

To verify, terraform plan should show either:

  • an update in-place (or small -/+ replacement) for the specific FTP rule, where source_address_prefix changes from "*"/"0.0.0.0/0" to "ALLOWED_FTP_SOURCE_CIDR", or
  • a new rule being added and any old unrestricted FTP rule being removed.