Groups | Blog | Home
all groups > iis ftp > june 2007 >

iis ftp : FTP Access Denied


Kbalz
6/14/2007 3:10:10 PM
After 3 hours, I've decided that whoever created Windows FTP in
Windows 2003 using IIS 6.0 was drunk.. its the most unusable thing MS
has ever released. Anyways I need help getting this working again.

I had it working 100% fine for my use, which was just me FTP files
with read/write access. Recently I had to add ability for a customer
to upload/download to the ftp, but I didn't want them messing with all
of my webserver, so i was able to setup protected access for this
customer.. It was by mere chance, I created the folder for the user,
and gave him the same user name, which apperantly restricts them to
just that folder by some magical and undocmented means. So when that
user logs in to the root of the FTP, it auto points them to their sub-
folder.

This week the other IT dude added a new FTP site, pointing to the same
IP as the live site but on a different port. This is the only change I
can think of since last I knew it worked.. Both the Admin account, and
the customer account can log in and can read all files, and download
them, but not upload, delete, change or do anything useful.

The error I get when uploading:
An error occured copying a file to the FTP Server. Make sure you have
permission to put files on the server. Details: 200 Type set to I.
227 Entering Passive Mode (yyy,yyy,y,y,xx,xx)*.
550 Access is denied.

Error I get when deleting:
An error occured copying a file to the FTP Server. Make sure you have
permission to put files on the server.
550 Access is denied.

*Note: [these xx numbers seem to change based on my folder location,
and the yyy.yy... is the webservers IP].

Okay, I log in webserver, check all file permissions, all set to full
control.. FTP is not taking anon connections. I've set the other FTP
site to All Unasigned, and stopped the site making the ftp site I'm
trying to use the only one on the IP. I've also reset IIS. I don't
know where to look next, there are only a few spots for permissions
and all of them say FULL CONTROL for Admin.. Still the errors are
there..

Where do I look, what do I try?
Bernard Cheah [MVP]
6/18/2007 12:00:00 AM
a) ensure write property in FTP site is checked.
b) try connect via ftp.exe, can you upload ?


--
Regards,
Bernard Cheah
http://www.iis.net/
http://www.iis-resources.com/
http://msmvps.com/blogs/bernard/


[quoted text, click to view]

Kbalz
6/18/2007 6:11:58 PM


On Jun 18, 2:34 am, "Bernard Cheah [MVP]"
[quoted text, click to view]

Yes, its checked.

[quoted text, click to view]

No. I get:

200 PORT command successful.
550 Access is denied.
Bernard Cheah [MVP]
6/19/2007 12:00:00 AM
well, you have ISA in between ? if yes, is the publishing rules allow write
operation?

--
Regards,
Bernard Cheah
http://www.iis.net/
http://www.iis-resources.com/
http://msmvps.com/blogs/bernard/


[quoted text, click to view]

Tony Girgenti
6/19/2007 8:28:18 AM
Hello.

It just so happens that i am having the same issue. I'm on a workstation
logged onto the server 2003 domain. The server has ISA running.

When i attempt to delete files through ftp from a website hosted by
goDaddy.com i get the 550 error.
I tried deleting them through goDaddy's ftp, VS2005 pro Copy Web Site and
IE6. Whatever way i try it, i get the same error
"--------------------------- FTP Folder Error ---------------------------
An error occurred deleting the file or folder on the FTP Server. Make sure
you have permission to access this folder. Details: 550 Access is denied."

Bernard, you say to check "if the publishing rules in ISA allow write". Can
you explain how to check/change that?

Any help would be gratefully appreciated.

Thanks,
Tony

[quoted text, click to view]

Kbalz
6/19/2007 1:00:59 PM
On Jun 19, 12:40 am, "Bernard Cheah [MVP]"
[quoted text, click to view]

Hmm - I ignored ISA server for many reasons. We have made many ISA
filtering changes, but near the top of the list, we have an "Admin
Allow All" rule.. where domain admins are allowed all traffic
outbound.

I also turned logging on when I attempted to do some FTP writes, and
the logging didn't show any Failures or Denied Actions.. so I assumed
it wasn't there.

I have a TEMP_Allow All rule, that allows all out-bound traffic for
all users. This rule is always disabled, unless I need to enable it to
test other ISA rules. I enabled my allow all rule, and now I can
write to the ftp.

I'm definatly no ISA expert (or FTP expert). But I would think that
if ISA has a problem with FTP traffic, why does it allow me to log in,
directory browse, download.. but not write..? How does ISA control
that? Aren't all FTP operations over the same port?

So I retract my rant on FTP.. the problem is in ISA.
Bernard Cheah [MVP]
6/20/2007 12:00:00 AM
@@ - the real setting is uncheck the 'read only' property.
Refer -
http://blogs.technet.com/jhoward/archive/2006/10/02/FTP-servers-appear-read_2D00_only-in-ISA-Server-2004.aspx


--
Regards,
Bernard Cheah
http://www.iis.net/
http://www.iis-resources.com/
http://msmvps.com/blogs/bernard/


[quoted text, click to view]

Bernard Cheah [MVP]
6/20/2007 12:00:00 AM
I'm not an ISA expert as well. but have you check the publishing rules -
read only property?
I'm pretty sure that you see 550 in ISA log, this is not the case?

More info -
http://blogs.technet.com/jhoward/archive/2006/10/02/FTP-servers-appear-read_2D00_only-in-ISA-Server-2004.aspx


--
Regards,
Bernard Cheah
http://www.iis.net/
http://www.iis-resources.com/
http://msmvps.com/blogs/bernard/


[quoted text, click to view]

Tony Girgenti
6/20/2007 10:10:11 AM
Hello Bernard.

I tried this and i still get the same 550 error.

I don't get it.

Thanks,
Tony

[quoted text, click to view]

Bernard Cheah [MVP]
6/21/2007 12:00:00 AM
is there anything you need to do to make the changes effective ? this is ISA
stuff, maybe republish?

after that - try again - check ISA log for 550 status.
if ISA is showing normal, look at IIS log, 550 ?

if yes, just for testing - disable ISA and check if you able to write.
if you can't and 550 is from IIS, get filemon to trace.

--
Regards,
Bernard Cheah
http://www.iis.net/
http://www.iis-resources.com/
http://msmvps.com/blogs/bernard/


[quoted text, click to view]

Kbalz
6/25/2007 5:15:49 PM
On Jun 20, 10:21 pm, "Bernard Cheah [MVP]"
[quoted text, click to view]

I think we figured out - part of it was the read only link you pasted
yes. The other part was, ISA wasn't authenticating requests, and was
denying anon. requests.. Putting the ISA Client on my machine worked,
and has worked for the other admins as well. If the isa client doesn't
work, we found activating this windows XP feature also helped..

Control Panel - Add Remove Programs - Windows Componets - Message
Queuing - Active Directory Integration.

Now sure WHY, but that helped authenticate users with ISA.

Very odd!
Bernard Cheah [MVP]
6/26/2007 12:00:00 AM
Cool! glad you fixed it.and for msmq ? lol weird indeed.

--
Regards,
Bernard Cheah
http://www.iis.net/
http://www.iis-resources.com/
http://msmvps.com/blogs/bernard/


[quoted text, click to view]

AddThis Social Bookmark Button