Train Signal Training - Free Computer Training Videos » Secure-FTP-Service

How to Setup User Authentication in FTP 7 on IIS 7.0

Dave Lawlor — Wed, 30 Apr 2008 15:00:12 +0000

As I wrote in the article Installing FTP 7 on IIS 7.0, Microsoft completely rewrote the FTP service code for Server 2008.

Included in this update were a number of ways to secure your FTP server against intrusion. One of the easiest ways to secure your FTP site is to have users authenticate instead of allowing anonymous access, and that’s what we’ll look at today.

For this article I will assume that you already have Server 2008, IIS 7, and FTP installed and ready to go. Now let’s secure your FTP servers.

User Authentication

In our first article on FTP, I showed you how to install and then configure an anonymous public site. This allowed anyone to get the files located in those directories.

While this is great for a certain type of site, if you require greater security you can setup authentication for your FTP site. We are going to look at two types of user authentication, one using Windows users and another using IIS Manager authentications.

Windows Users FTP Authentication

This type of user authentication allows the FTP site to use the local Server user accounts/groups for access to the FTP site.

This example assumes you already have a user created for this purpose and given the account access to the FTP directory; we are using the account FTPUser.

1. Start by opening IIS Manager

2. Right click on Sites, and then click on Add FTP Site …

3. Fill in the site name and path to the directory that will hold the files. We are using WindowsFTPuser.com and C:\inetpub\privateftp for our example. Click Next when done.

4. Choose an IP for this FTP site to use, and change the radio button to Allow SSL. Leave the rest of the setting alone for now.

5. In this window we will specify what users are allowed access and Read/Write permissions will be assigned to those users.

Check the box next to Basic, set the dropdown to Specified users, under that type in the user name (in our case FTPUser), and check Read & Write. Click Next after you enter all the information.

6. That ends the FTP site wizard, if you want to add or remove users after the initial setup, in the IIS Manager click on the site you want to manage and then click on FTP Authorization Rules.

7. In this pane you can select to Add Allow Rule …, Add Deny Rule …, and Remove. This allows you to manage access to your ftp site through basic Windows authorization.

With this configuration only those users assigned to the FTP site will be allowed access. Please note that you can also use Group permissions the same way.

IIS Manager Authentication

For a long time compared to *nix implementations of FTP, Windows was sorely lacking. One of the biggest hurdles was the fact that if you had site managers who wanted to give access to certain users there would have to be a corresponding account setup for them on the local server. Not the best situation from a security or administration standpoint.

With the release of FTP 7 and IIS 7 this has been corrected by the use of IIS 7 Management Service. In this example, I’m going to setup the service and apply the users to the domain we setup earlier.

1. We have to grant special permissions to the Network Service to be able to use this Service so open up a command prompt.

2. Type the following:

CACLS “%SystemDrive%\Windows\System32\inetsrv\config” /G “Network Service”:R /E

CACLS “%SystemDrive%\Windows\System32\inetsrv\config\administration.config” /G “Network Service”:R /E

CACLS “%SystemDrive%\Windows\System32\inetsrv\config\redirection.config” /G “Network Service”:R /E

Now we have to give rights to the Network Service to the root FTP folder, in our instance this is C:\inetpub\privateftp. When you run this command replace the directory with your own.

3. Open Command Prompt

4. Type the following:

CACLS “%SystemDrive%\inetpub\privateftp” /G “Network Service”:C /T /E

Next we need to install the IIS 7.0 management service on the server.

5. Open Server Manager

6. Open the Roles, find the Web Server (IIS) role, and click on Add Role Services.

7. In the Select Role Services window scroll down till you find Management Service, if it is unchecked then place a check mark next to it and click Next.

If there are any required features that also need to be installed you will be prompted to install those also.

8. Next you will have a summary screen of everything that is going to be installed, click Install to start the process.

9. The next window will show you the progress of the installation process.

10. Installation Results window will appear when the installation is finished, click on Close when done.

11. Open IIS Manager

Select the server in IIS Manager; in our case, TSTEST, and scroll down in the center pane to Management Service and click on it.

12. In the Management Service pane, look for the Identity Credentials box and select Windows credentials or IIS Manager credentials, then click Apply.

13. In the connections pane select the server you are working on, and double click on IIS Manager Users.

14. Click on Add User … in the Actions pane.

15. Now you will create a user account that can be used, in our case I am going to add Gomer and enter a password for that user.

16. You will now see that the user is created and you can do some limited administration in this panel for those users, including Disable User and Change Password.

17. Now click the site you want to configure to use IIS 7 Manager Authentication in the connections pane, choose FTP Authentication in the center pane

18. Click on Custom Providers in the action pane.

19. In the Custom Providers dialog window place a check next to IisManagerAuth, then click Ok.

20. Now let’s add the user we created earlier by selecting the FTP site in the connections pane and then select IIS Manager Permissions in the center panel.

21. Click on Allow User … in the Actions pane

22. The Allow User … dialog box now shows both types of users, Windows & IIS Manager. In our case we are going to click the Select … button.

23. In the Users dialog select the user, (Gomer in our case) and click OK.

24. Click Ok to continue and add the user to IIS Manager Permissions.

25. Now we have to add an authorization rule, so let’s choose the site again in the connection pane, then FTP Authorization Rules, in the central pane.

26. Select Add Allow Rule … in the actions pane.

27. The Add Allow Authorization Rule dialog box is next, so select Specified users and type the users’ names in, separated by commas. Place a check next to either or both Read/Write permissions, and click OK.

We have now setup this site to use both types of users Windows and IIS Manager Users. You can use these in conjunction with each other or completely independent of the other — all depending on the needs of your organization.

Windows Server 2008 Active Directory Training — Now Available!

Get complete coverage for the new 70-640 exam and get started on your MCITP certification.

Master Active Directory terms, learn about creating, organizing, and managing Users and Groups, installing and upgrading Domain Controller and much more — all on Windows Server 2008.

Installing FTP Publishing Service for IIS 7.0

Dave Lawlor — Fri, 25 Apr 2008 15:00:26 +0000

If you’ve been administrating IIS for any amount of time and had a need for FTP service you know that Windows Server has been lacking in that arena for years.

With the release of Server 2008 and IIS 7 I was hoping to see some improvements, but alas it wasn’t to be. As I started to once again consider 3rd party alternatives for FTP, Microsoft released FTP Publishing Service for IIS 7.0, as a separate download.

Completely rewritten from the ground up the FTP service incorporates new features, security, & deployment options for FTP on server 2008. The following are some of the improvements you will find in this release:

Integration with IIS 7.0 – If you have used the FTP service that ships with Server 2008, you know that it was the same as the one that shipped with Server 2003, and you were even forced to install the management console for IIS 6 to manage it.

With this release it has an updated administrative interface; it removes the use of the IIS 6 metabase and replaces it with a configuration store based on .NET XML-based *.config format.

Secure FTP Service – Now you can use SSL to secure your FTP service.

IPv6 Support – Forward looking for support when the conversion to IPv6 takes place

Improved FTP Logging – Enhanced to include unique tracking for FTP tracking and includes all FTP related traffic with detailed FTP messages in the logs.

Authentication for Non-Windows Accounts – Added support for Web Manager authentication and ASP .NET Membership authentication, allowing webmasters to use non-windows accounts to authenticate FTP users.

Support for Virtual Hosts – Now FTP is available for virtual sites hosted on same IP

FTP Publishing for IIS 7 Requirements

The following requirements need to be met before you install the new FTP service:

Must be using Windows Server 2008
IIS 7 must be installed – See Installing IIS 7 if you need help
Must install the FTP service as an administrator
IIS 7 administration tool installed to manage the service using the IIS 7 interface
The FTP service that shipped with Server 2008 MUST be UNINSTALLED.

Download Microsoft FTP Publishing Service for IIS 7.0

Download the correct version depending on the server version you are using:

Install FTP for IIS 7

Ok, we got that all out of the way let’s go ahead and get our hands dirty with the actual installation of the service and take it for a test spin.

1. After download go ahead and navigate to the directory and double click the MSI file. After a second you will get the following Welcome window, click Next to move on

2. The License terms are up next, go ahead and place a check next to I accept the terms in the License Agreement and click Next

3. No typical setup for the power users of FTP! Custom setup is the only option and this screen shows you your options for install.

The only one I can really see as being option is the Managed Code Support, if you would be using any kind of code to work with the FTP service. In this instance we will install everything, by clicking Next.

If you are worried about disk space you can check what you have available by clicking Disk Usage. The total space required by the full install of this service is 4387KB.

4. The moment of truth! Click on the Install button to start the installation of the FTP service.

5. The install process will start and check that your server has all the requirements.

If one of the requirements is not met you will get a window that tells what service is missing and where to go to install it.

6. At the end of the setup routine you will see the following screen, which also has access to the release notes. Click on Finish, to complete the install.

That completes the install instructions for FTP Publishing Service for IIS 7. Let’s take a quick look at what it takes to configure a new FTP site.

Create an Anonymous FTP Site

Anonymous FTP sites are useful when you have files that you want to distribute to the public via FTP and do not require any kind of login or security.

1. Start Internet Information Services (IIS) Manager

2. Right click on Sites, and left click on Add FTP Site. You can also click on Add FTP Site in the Actions pane.

3. Now add a FTP site name and a file location for the public files. In this case I will use TSTPublicFTP.com and created the directory publicftp under C:/inetpub, but you can place the files in any directory.

4. Choose an IP address or the default All Unassigned, leave the virtual host space blank, you can leave the Start FTP site automatically checked, SSL Certificate can be set at Not Selected, and the radio button set to Allow SSL, click Next to continue.

5. The next window lets you set the access rights through the FTP service. In our instance we are going to check the box next to Anonymous in the Authentication box.

Set the dropdown to Anonymous users and check the box next to Read rights. These settings will allow all anonymous users to connect to this site with Read-only rights.

Click Finish to continue.

6. After a short pause you will be able to see that the FTP site was added to the IIS Manager console, and can be managed from there.

In this article we have installed Microsoft FTP Publishing Service for IIS 7.0 and configured a public anonymous access FTP site for users to connect to.