CrushFTP Server Hardening — June 2026
Summary
Security review and hardening of the production SFTP server vm-eshars-sftp
(Windows Server 2019, CrushFTP), prompted by an effort to close its exposure
without a full platform migration. The server is internet-facing and carries
all district SFTP file exchange, so it is a high-value target.
Outcome: network exposure of the CrushFTP admin interface was closed, the NSG was cleaned of brittle/misleading rules, the running version was confirmed patched against the known actively-exploited CVEs, and a multi-factor gap on the admin accounts was identified (remediation owner-driven, see below).
Server facts (as reviewed 2026-06-11)
| Item | Value |
|---|---|
| VM | vm-eshars-sftp (RG VM-ESHARS-SFTP_GROUP) |
| OS | Windows Server 2019 Datacenter |
| Size | Standard_D2s_v3 |
| Public IP | 40.77.98.52 |
| Private IP | 10.0.0.11 |
| Software | CrushFTP 10.8.5 Build 16 (paid license) |
| Listening ports | 22 (SFTP), 443 / 8080 / 9090 (CrushFTP web/admin) |
| Accounts | 273 user.XML accounts; 2 admins (esharsadmin, hisd-admin) |
Findings & actions
1. CrushFTP admin web ports were exposed on all interfaces — FIXED
CrushFTP listened on 443/8080/9090 bound to all interfaces. The NSG’s only protection for those ports was a single low-priority catch-all deny — one mis-edit away from exposing the admin interface to the internet. CrushFTP’s actively-exploited CVEs (auth bypass, RCE) are reached via exactly these web/admin ports.
Action: added explicit high-priority Internet-deny rules to
vm-eshars-sftp-nsg:
| Priority | Rule | Action | Port | Source |
|---|---|---|---|---|
| 200 | DenyInternetAdminHTTP | Deny | 8080 | Internet |
| 210 | DenyInternetAdminHTTPS | Deny | 443 | Internet |
| 220 | DenyInternetAdmin9090 | Deny | 9090 | Internet |
Admin UI is now reachable only over the VPN. SFTP (port 22) is unchanged.
2. Brittle / misleading NSG rules — REMOVED
AllowLeonRDP— RDP allowed from a hardcoded residential IP (67.164.57.235). Removed;AllowVpnRDP(172.16.201.0/24) already provides admin RDP over the VPN.AllowWebInterfaceKisha— named “Allow” but was actually a Deny of 443 from two IPs. Redundant once rule 210 denies 443 from all Internet, and the misleading name was an audit hazard. Removed.
Final NSG (inbound)
| Priority | Name | Access | Port | Source |
|---|---|---|---|---|
| 200 | DenyInternetAdminHTTP | Deny | 8080 | Internet |
| 210 | DenyInternetAdminHTTPS | Deny | 443 | Internet |
| 220 | DenyInternetAdmin9090 | Deny | 9090 | Internet |
| 300 | AllowVpnRDP | Allow | 3389 | 172.16.201.0/24 |
| 1000 | DenyInPublicIP | Deny | * | (2 blocklisted IPs) |
| 1002 | SSH | Allow | 22 | * |
| 1003 | DenyAllInbound_Isolation | Deny | * | * |
3. Version — CONFIRMED PATCHED
Running CrushFTP 10.8.5. This is past the patch line for the known CISA-KEV (actively exploited) vulnerabilities:
- CVE-2025-31161 (auth bypass) — patched in 10.8.4 → not exposed
- CVE-2024-4040 (RCE) — patched in 10.7.1 → not exposed
No emergency upgrade required. CrushFTP signals a newer build is available; an upgrade to the latest 10.x or 11.x is a longevity/support-runway decision, not a security emergency. MFA + the NSG lockdown address the real risk.
4. MFA on admin accounts — GAP IDENTIFIED, remediation pending
Scan of all 273 user.XML files found zero accounts with MFA enrolled,
including both admin accounts (esharsadmin, hisd-admin). All authentication
is password-only.
Action required (owner-driven, interactive): enable TOTP two-factor on both admin accounts via the CrushFTP web UI (User Manager → account → Two-Factor). Not done remotely by design — the TOTP secret is the second factor and must be enrolled by the account owner scanning the QR into an authenticator app. CrushFTP 10.8.5 supports this; no upgrade needed.
Optionally set a server-wide policy requiring 2FA for admin-permission accounts.
Residual risk / not done
- Public IP retained. Port 22 must be exposed for districts regardless. An Azure Load Balancer fronting a private VM is a possible future improvement (VM goes private, stable frontend, HA) but is architecture work, not hardening — deferred.
- Windows Server 2019 is the aging component; addressed only by the (paused) SFTPGo migration, not by CrushFTP changes. See INFRA-0008 decision.
- MFA enrollment outstanding (above).