turbot/steampipe-mod-azure-compliance

Control: 9.9 Ensure FTP deployments are Disabled

Description

By default, Azure Functions, Web, and API Services can be deployed over FTP. If FTP is required for an essential deployment workflow, FTPS should be required for FTP login for all App Service Apps and Functions.

Azure FTP deployment endpoints are public. An attacker listening to traffic on a wifi network used by a remote employee or a corporate network could see login traffic in clear-text which would then grant them full control of the code base of the app or service. This finding is more severe if User Credentials for deployment are set at the subscription level rather than using the default Application Credentials which are unique per App.

Remediation

From Azure Portal

  1. Go to the Azure Portal.
  2. Select App Services.
  3. Click on an app.
  4. Select Settings and then Configuration.
  5. Under General Settings, for the Platform Settings, the FTP state should be set to Disabled or FTPS Only.

From Azure CLI

For each out of compliance application, run the following choosing either 'disabled' or 'FtpsOnly' as appropriate:

az webapp config set --resource-group <resource group name> --name <app name> --ftps-state [disabled|FtpsOnly]

From PowerShell

For each out of compliance application, run the following:

Set-AzWebApp -ResourceGroupName <resource group name> -Name <app name> - FtpsState <Disabled or FtpsOnly>

Default Value

By default, FTP based deployment is All allowed.

Usage

Run the control in your terminal:

powerpipe control run azure_compliance.control.cis_v210_9_9

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run azure_compliance.control.cis_v210_9_9 --share

SQL

This control uses a named query:

select
fa.id as resource,
case
when configuration -> 'properties' ->> 'ftpsState' = 'AllAllowed' then 'alarm'
else 'ok'
end as status,
case
when configuration -> 'properties' ->> 'ftpsState' = 'AllAllowed' then name || ' FTP deployments enabled.'
else name || ' FTP deployments disabled.'
end as reason
, fa.resource_group as resource_group
, sub.display_name as subscription
from
azure_app_service_function_app fa,
azure_subscription sub
where
sub.subscription_id = fa.subscription_id
union
select
wa.id as resource,
case
when configuration -> 'properties' ->> 'ftpsState' = 'AllAllowed' then 'alarm'
else 'ok'
end as status,
case
when configuration -> 'properties' ->> 'ftpsState' = 'AllAllowed' then name || ' FTP deployments enabled.'
else name || ' FTP deployments disabled.'
end as reason
, wa.resource_group as resource_group
, sub.display_name as subscription
from
azure_app_service_web_app as wa,
azure_subscription as sub
where
sub.subscription_id = wa.subscription_id;

Tags