Groups | Blog | Home
all groups > iis ftp > july 2006 >

iis ftp : FTP, User id specific home directories


Bruce Parker
7/18/2006 11:46:01 AM
Using local accounts, how do I assign each individual account to different
home directories based from one common root. We do not want to use active
directory to assign these home directories to the user.

For example,

FTPHomeDirectory
FTPHomeDirectory\Human Resources (tied to local account, HRUser)
FTPHomeDirectory\Sales (tied to local account, SalesUser)

Bruce Parker
7/18/2006 12:45:01 PM
Thanks for quick response Chris. We were hoping for a different answer.
This forces a directory structure on us. We were hoping to map to an
existing folder structure containing documents and pointing users to these
folders.

Thanks again.

[quoted text, click to view]
Chris Crowe [MVP 1997 -> 2006]
7/19/2006 12:00:00 AM
If you are using IIS 5.0 then you can only do this by the following:

Create your FTP Home directory and configure the FTP site to use it.
You must leave the FTP home directory open to all users.
You then need to lock each folder down such as "Human Resources" to only
those users who log on with HR User.
You can have the folder automatically changed into the same name as the
account if that folder exists. SO for example in with HRUser account if
there was a folder called HRUser in the FTP Home directory when that user
logs on they would be automatically moved to that folder to start with.

Now - the user will ALWAYS be able to CWD .. to the parent folder which is
the FTP Home directory

The other option (probably the one you want) is use IIS 6 on Windows 2003
Server - it supports home directories for specific accounts but you can not
have a local user account HRUser go to a folder called "Human Resources"
they would need to go to HRUser.

Have a read of this small article I wrote for IIS Insider which explains the
differences and how to configure them.
http://www.microsoft.com/technet/community/columns/insider/default.mspx

--


Chris Crowe [ IIS MVP - 1997 - 2006 ]
http://blog.crowe.co.nz


[quoted text, click to view]

v-wywang NO[at]SPAM online.microsoft.com
7/19/2006 10:07:43 AM
Hi Bruce

Based on my understanding, you want to assign each individual account to an
existing folder based from one common root.

If the IIS server has joined into domain, you can enable the new FTP Active
Directory User Isolation feature of IIS6 to dispatch users into their own
FTP home directories.

Please refer to the detailed steps below.

To create FTP sites with Isolate users using Active Directory mode
1. In IIS Manager, click the local computer, right-click the
FTP Sites folder, point to New, and click FTP Site.
2. In the Welcome to the FTP Site Creation Wizard, click Next.
3. In FTP Site Description, type a description for the FTP
site, and then click Next.
4. In IP Address and Port Settings, type an IP address and
port, and then click Next.
5. In FTP User Isolation, click Isolate users using Active
Directory, and then click Next.
6. In the User name text box, type the user name, using the
Domain\User format. Choose a user with minimal domain privileges. This user
name is used to access Active Directory and read the home directory
properties.
7. In the Password text box, type the password of the user.
8. In the Enter the default Active Directory domain text box,
type the default domain name.
This domain name is used for the users who do not specify their user domain
when they log on. In other words, a user connecting with the user name
Domain1\User1 is authenticated against Domain1, while a user connecting as
User2 is authenticated against the default logon domain. If a default
domain is not named and a user does not specify a domain name, access is
denied for all but anonymous users. Type the base domain name only, not the
fully qualified name. For example, type MyDomain, not
MyDomain.dept.microsoft.com.
9. Click Next. You are prompted to re-enter the password for
the user entered in the previous steps.
10. Follow the directions to complete the wizard.
By default, anonymous access is disabled to sites created in this isolation
mode.

To prepare to convert an existing FTP site to Isolate users using Active
Directory mode
1. Plan user distribution over your network file server
resources.
2. Create server shares and user directories for all users that
have access to FTP.
3. Make sure to create a directory for anonymous access (if you
want to enable anonymous user connections).
4. For each user, set the msIIS-FTPRoot and msIIS-FTPDir
properties in Active Directory to point to the new home directory using
Iisftp.vbs, by typing the following at the command line:
Iisftp.vbs /SetADProp UserName FTPRoot Server\Share
Iisftp.vbs /SetADProp UserName FTPDir Directory
For complete Iisftp.vbs syntax, see "Setting Active Directory User
Isolation" in IIS 6.0 Help, or type Iisftp.vbs /SetADProp /? at the command
prompt.

To enable anonymous access for the FTP site configured with Isolate users
using Active Directory mode
1. Configure the metabase properties as shown in the following
example. You can do so by using the adsutil.vbs SET command-line tool.
adsutil set /msftpsvc/6634/AllowAnonymous "TRUE"
adsutil set /msftpsvc/6634/AnonymousOnly "FALSE"
adsutil set /msftpsvc/6634/AnonymousUserName
"MyDomain\LowPrivUser"
adsutil set /msftpsvc/6634/AnonymousUserPass "PaSsWoRd"

The link of IIS6 resource kit is
http://www.microsoft.com/downloads/details.aspx?familyid=80a1b6e6-829e-49b7-
8c02-333d9c148e69&displaylang=en+

And the corresponding chapters is
Part II: Ch 8: Configuring Internet Sites and Services

Please let me know if you have any further questions. Thanks.
Best Regards,
WenYuan Wang
Microsoft Online Community Support
==================================================
Get notification to my posts through email? Please refer to:
http://msdn.microsoft.com/subscriptions/managednewsgroups/default.aspx#notif
ications.

Note: The MSDN Managed Newsgroup support offering is for non-urgent issues
where an initial response from the community or a Microsoft Support
Engineer within 1 business day is acceptable. Please note that each follow
up response may take approximately 2 business days as the support
professional working with you may need further investigation to reach the
most efficient resolution. The offering is not appropriate for situations
that require urgent, real-time or phone-based interactions or complex
project analysis and dump analysis issues. Issues of this nature are best
handled working with a dedicated Microsoft Support Engineer by contacting
Microsoft Customer Support Services (CSS) at:

http://msdn.microsoft.com/subscriptions/support/default.aspx.
==================================================

This posting is provided "AS IS" with no warranties, and confers no rights.
Bob [MSFT]
7/19/2006 11:10:03 AM
Hi Bruce,

I wrote the following blog entry a couple of months ago that might help:

http://blogs.msdn.com/robert_mcmurray/archive/2006/05/08/592821.aspx

-- Bob [MSFT]

[quoted text, click to view]

v-wywang NO[at]SPAM online.microsoft.com
7/21/2006 12:00:00 AM
Hi Bruce,

Just want to check if the issue has been resolved?
If it still persists, please don't hesitate to update here.
We'll go on to assist you on it. Thanks.

Best Regards,
WenYuan Wang
Microsoft Online Community Support
AddThis Social Bookmark Button