Azure App Service FTPS

Question

Azure Advisor recommends FTPS in my webapp. If thats the case why isn't it enabled by default. What is the reason it was not enabled by default.

As per this article https://learn.microsoft.com/en-us/azure/app-service/deploy-ftp it states The FTP/S endpoint for your app is already active. No configuration is necessary to enable FTP/S deployment.

Answer 1

Hello @Nick Diaz

Both FTP and FTPS are enabled by default in Azure App Service

FTPS (Secure FTP) is used to enhance security for your Azure web application as it adds an extra layer of security to the FTP protocol, and help you to comply with the industry standards and regulations.

With FTP, the transmission of data between the web application and the FTP client is unencrypted, leaving the data vulnerable to being intercepted and read. Even if a Man-in-the-Middle (MITM) attack is a risk that you can quickly mitigate, industry requirements such as PCI DSS, HIPAA, and others require data transfers to be fully encrypted. Enforcing FTPS-only access for your Azure App Services applications, can guarantee that the encrypted traffic between the web application servers and the FTP clients cannot be decrypted by malicious actors in case they are able to intercept packets sent across the FTP connection.

https://www.cloudconformity.com/knowledge-base/azure/AppService/enable-ftps-only.html#