Skip to main content

⭐ Repository → 📁 Compliance Engine → 📁 CloudAware → 📁 Azure → 📁 Virtual Network

🛡️ Azure Network Security Group allows public access to FTP ports🟢

  • Contextual name: 🛡️ Security Group allows public access to FTP ports🟢
  • ID: /ce/ca/azure/virtual-network/security-group-allows-unrestricted-ftp-traffic
  • Tags:
  • Policy Type: COMPLIANCE_POLICY
  • Policy Categories: SECURITY

Logic​

Description​

Open File

Description​

Ensure that Azure Network Security Groups are not configured with Network Security Group (NSG) rules that allow unrestricted inbound access to FTP services on ports 20 and 21 from the public internet (e.g., source IP ranges 0.0.0.0/0 or ::/0). FTP traffic should be tightly controlled and limited to trusted IP ranges to reduce exposure to external threats.

Rationale​

FTP (File Transfer Protocol), which operates over TCP ports 20 (data) and 21 (control), is an outdated and insecure protocol that transmits data—including credentials—in cleartext. Allowing unrestricted external access to these ports exposes systems to significant risks, including brute-force attacks, credential harvesting, unauthorized data exfiltration, and exploitation by automated bots. Restricting access to known, trusted sources reduces the attack surface and strengthens the overall security posture.

Impact​

Restricting FTP access may impact legitimate services if they rely on open access to these ports. Proper planning, validation, and testing are essential when implementing changes to avoid service disruption. Where possible, consider migrating to more secure file transfer protocols such as SFTP or FTPS, which offer encrypted communications and enhanced authentication mechanisms.

... see more

Remediation​

Open File

Remediation​

Modify or Remove Insecure NSG Rule​

Review the security rules associated with the relevant Network Security Group (NSG) and determine whether they are required. Take appropriate action based on necessity and scope:

  • If the rule is not required: Remove the rule entirely.

  • If the rule is required but overly permissive: Update the rule to narrowly scope access, restricting the source IP range to only what is strictly necessary.

Azure CLI​

  1. Delete the rule:

    az network nsg rule delete \
      --resource-group {{resource-group-name}} \
      --nsg-name {{nsg-name}} \
      --name {{rule-name}}

  2. Restrict the rule:

    az network nsg rule update \
        --resource-group {{resource-group-name}} \
        --nsg-name {{nsg-name}} \
        --name {{rule-name}} \
        --source-address-prefixes {{trusted-cidr}}

    Replace placeholders with the appropriate values. Use space-separated values for multiple source prefixes or destination ports (e.g., --source-address-prefixes "1.2.3.4/32 5.6.7.8/32").

... see more

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 Cloudaware Framework → 💼 Public and Anonymous Access80no data