iis ftp: How to secure FTP? -- iis ftp

Re: How to secure FTP?

jeff.nospam NO[at]SPAM zina.com
6/25/2004 6:43:53 PM

[quoted text, click to view]

Some bank. Operating with one voluneter working one day a week...

[quoted text, click to view]

Sure you can. Use virtual folders and the proper NTFS permissions.

[quoted text, click to view]

Not sure I follow that...

[quoted text, click to view]

Server 2003 has a user isolation mode that helps, but you'll still
need to use virtual folders to point two users to the same physical
folder. Might start with:

HOW TO: Set Up an FTP Server in Windows Server 2003
http://support.microsoft.com/default.aspx?scid=kb;en-us;323384

How To Set Up an FTP Site So That Users Log Onto Their Folders:
http://support.microsoft.com/default.aspx?scid=kb;EN-US;201771

HOW TO: Create a Secure FTP Directory that Uses Password
Authentication:
http://support.microsoft.com/?id=239120

Jeff

[quoted text, click to view]

Re: How to secure FTP?

JW
6/26/2004 12:48:57 AM

I use XP Pro and it allows up to 10 simultaneous connections to an FTP site.
Surely 2003 Server will allow more than that. All they need is a username
and password. NTFS permissions should take good care of security, unless
permissions are set up wrong, such as if the group named Everyone is allowed
access to folders they should not have access to.

[quoted text, click to view]
It seems like MY bank works that way! Although I don't think they volunteer,
I think they are forced to be there!

If I understand the FTP articles correctly, I can only have one user logon
that would connect them directly to their folder. How would I have fred,
barney and wilma be able to automatically connect to the same directory? . .
.. .or is it only the VIRTUAL directory that had to match the username...
Hmmm.... I just thought about that.

Is FTP as secure as anything else on the web? I see in my logs lots of
attempts to enter the FTP site, mostly from odd names like DATA, WWW, WEB,
SYSTEM etc.

[quoted text, click to view]

Re: How to secure FTP?

jeff.nospam NO[at]SPAM zina.com
6/26/2004 2:06:37 PM

[quoted text, click to view]

Each user has a virtual folder that points to the same physical
folder. So Joe would have a home directory like c:\ftphomes\joe and
Mary would have a home directory like c:\ftphomes\mary, but both would
have a virtual foldet that pointed to c:\allusers or wherever you want
the shared data.

In W2K see:

HOW TO: Create a Virtual Directory in Internet Information Services
(IIS)
http://support.microsoft.com/?id=172138

Jeff

[quoted text, click to view]

Re: How to secure FTP?

jeff.nospam NO[at]SPAM zina.com
6/26/2004 8:32:24 PM

On Sat, 26 Jun 2004 23:21:27 +0400, "Oleg" <crushkov@lainer.net.ru>
[quoted text, click to view]

I'm not sure I understand this. Are you saying you can't assign
permission to a group and have tyo assign it to each member of the
group? If so, there's something wrong with your group permissions.

Re: How to secure FTP?

Oleg
6/26/2004 11:21:27 PM

I have Windows 2000 Server SP4 rus
and when I am set NTFS permissions to folder on my ftp for some group
for example FTP_USERS it's dont't work, but if I'm add a user from the group
and set NTFS permissions only to him
rules is work (Users Are added to other group too)

Re: How to secure FTP?

mmac
6/27/2004 1:24:54 AM

OK that makes sense.
I'll give it a go.
So I am also hearing in this thread that secure FTP isn't really necessary for
my application? It's meant more for encryption than anything else?

[quoted text, click to view]

Re: How to secure FTP?

mmac
6/28/2004 10:39:30 AM

Thank you , that was quite clear and understandable. I'll leave well enough
alone for now and read up on SSL (since I need to set that up for my
exchange OWA anyway. ) Once I figure that out I'll see if it would fit for
FTP. Though from your explanaition I hardly need it.

[quoted text, click to view]

Re: How to secure FTP?

alunj NO[at]SPAM online.microsoft.com (
6/28/2004 4:54:22 PM

[quoted text, click to view]

Like I said, it really depends on what you mean by "secure FTP".

To some people, FTP as described by the basic standards document is not
secure, because it doesn't encrypt usernames and passwords. In practice,
you're not going to find many people that have the ability to make good on
that, because it means they must somehow put themselves, and their
monitoring machines, on the network path between your server and your
client. [Either by intercepting the current path, or by changing your path
to go to them first] This is about as likely, in the average case, as a
telephone wiretap - and you use the phone all the time without scrambling
technology.

To others, the only security they need is the knowledge that the user name
and password are required by the server in order to log on, and that users
so authenticated are kept to the right places. Basic FTP provides that.

But there are standards for providing encryption and authentication through
other mechanisms (such as SSL) that are supported by a number of third
party clients and servers - you can even get proxies / wrappers that can
turn IIS into such an encrypting server.

Alun.
~~~~

Re: How to secure FTP?

jeff.nospam NO[at]SPAM zina.com
6/28/2004 7:02:09 PM

[quoted text, click to view]

Well, if it *does* fit you'll need to use a FTP service other than
Microsoft's, which won't do secure FTP. :)

Jeff

[quoted text, click to view]

Got something to say? Click here to post a reply to this thread.

Don't see what you're looking for? Try a search.

View other messages in the iis ftp group.