How to Setup User Authentication in FTP 7 on IIS 7.0

As I wrote in the article on installing FTP 7 on IIS 7.0, Microsoft completely rewrote the FTP service code for Server 2008. Included in this update were a number of ways to secure your FTP server against intrusion. One of the easiest ways to secure your FTP site is to have users authenticate instead of allowing anonymous access, and that’s what we’ll look at today.

For this article I will assume that you already have Server 2008, IIS 7, and FTP installed and ready to go. Now let’s secure your FTP servers.

In our first article on FTP, I showed you how to install and then configure an anonymous public site. This allowed anyone to get the files located in those directories.

While this is great for a certain type of site, if you require greater security you can setup authentication for your FTP site. We are going to look at two types of user authentication, one using Windows users and another using IIS Manager authentications.

This type of user authentication allows the FTP site to use the local Server user accounts/groups for access to the FTP site.

This example assumes you already have a user created for this purpose and given the account access to the FTP directory; we are using the account FTPUser.

1. Start by opening IIS Manager

2. Right click on Sites, and then click on Add FTP Site …

How to Setup User Authentication in FTP 7 on IIS 7.0 - 1

3. Fill in the site name and path to the directory that will hold the files. We are using WindowsFTPuser.com and C:inetpubprivateftp for our example. Click Next when done.

How to Setup User Authentication in FTP 7 on IIS 7.0 - 2

4. Choose an IP for this FTP site to use, and change the radio button to Allow SSL. Leave the rest of the setting alone for now.

How to Setup User Authentication in FTP 7 on IIS 7.0 - 3

5. In this window we will specify what users are allowed access and Read/Write permissions will be assigned to those users.

Check the box next to Basic, set the dropdown to Specified users, under that type in the user name (in our case FTPUser), and check Read & Write. Click Next after you enter all the information.

How to Setup User Authentication in FTP 7 on IIS 7.0 - 4

6. That ends the FTP site wizard, if you want to add or remove users after the initial setup, in the IIS Manager click on the site you want to manage and then click on FTP Authorization Rules.

How to Setup User Authentication in FTP 7 on IIS 7.0 - 5

7. In this pane you can select to Add Allow Rule …, Add Deny Rule …, and Remove. This allows you to manage access to your ftp site through basic Windows authorization.

How to Setup User Authentication in FTP 7 on IIS 7.0 - 6

With this configuration only those users assigned to the FTP site will be allowed access. Please note that you can also use Group permissions the same way.

IIS Manager Authentication

For a long time compared to *nix implementations of FTP, Windows was sorely lacking. One of the biggest hurdles was the fact that if you had site managers who wanted to give access to certain users there would have to be a corresponding account setup for them on the local server. Not the best situation from a security or administration standpoint.

With the release of FTP 7 and IIS 7 this has been corrected by the use of IIS 7 Management Service. In this example, I’m going to setup the service and apply the users to the domain we setup earlier.

1. We have to grant special permissions to the Network Service to be able to use this Service so open up a command prompt.

2. Type the following:

CACLS “%SystemDrive%WindowsSystem32inetsrvconfig” /G “Network Service”:R /E

CACLS “%SystemDrive%WindowsSystem32inetsrvconfigadministration.config” /G “Network Service”:R /E

CACLS “%SystemDrive%WindowsSystem32inetsrvconfigredirection.config” /G “Network Service”:R /E

Now we have to give rights to the Network Service to the root FTP folder, in our instance this is C:inetpubprivateftp. When you run this command replace the directory with your own.

3. Open Command Prompt

4. Type the following:

CACLS “%SystemDrive%inetpubprivateftp” /G “Network Service”:C /T /E

Next we need to install the IIS 7.0 management service on the server.

5. Open Server Manager

6. Open the Roles, find the Web Server (IIS) role, and click on Add Role Services.

How to Setup User Authentication in FTP 7 on IIS 7.0 - 7

7. In the Select Role Services window scroll down till you find Management Service, if it is unchecked then place a check mark next to it and click Next.

If there are any required features that also need to be installed you will be prompted to install those also.

How to Setup User Authentication in FTP 7 on IIS 7.0 - 8

8. Next you will have a summary screen of everything that is going to be installed, click Install to start the process.

How to Setup User Authentication in FTP 7 on IIS 7.0 - 9

9. The next window will show you the progress of the installation process.

How to Setup User Authentication in FTP 7 on IIS 7.0 - 10

10. Installation Results window will appear when the installation is finished, click on Close when done.

How to Setup User Authentication in FTP 7 on IIS 7.0 - 11

11. Open IIS Manager

Select the server in IIS Manager; in our case, TSTEST, and scroll down in the center pane to Management Service and click on it.

How to Setup User Authentication in FTP 7 on IIS 7.0 - 12

12. In the Management Service pane, look for the Identity Credentials box and select Windows credentials or IIS Manager credentials, then click Apply.

How to Setup User Authentication in FTP 7 on IIS 7.0 - 13

13. In the connections pane select the server you are working on, and double click on IIS Manager Users.

How to Setup User Authentication in FTP 7 on IIS 7.0 - 14

14. Click on Add User … in the Actions pane.

How to Setup User Authentication in FTP 7 on IIS 7.0 - 15

15. Now you will create a user account that can be used, in our case I am going to add Gomer and enter a password for that user.

How to Setup User Authentication in FTP 7 on IIS 7.0 - 16

16. You will now see that the user is created and you can do some limited administration in this panel for those users, including Disable User and Change Password.

How to Setup User Authentication in FTP 7 on IIS 7.0 - 17

17. Now click the site you want to configure to use IIS 7 Manager Authentication in the connections pane, choose FTP Authentication in the center pane

How to Setup User Authentication in FTP 7 on IIS 7.0 - 18

18. Click on Custom Providers in the action pane.

How to Setup User Authentication in FTP 7 on IIS 7.0 - 19

19. In the Custom Providers dialog window place a check next to IisManagerAuth, then click Ok.

How to Setup User Authentication in FTP 7 on IIS 7.0 - 20

20. Now let’s add the user we created earlier by selecting the FTP site in the connections pane and then select IIS Manager Permissions in the center panel.

How to Setup User Authentication in FTP 7 on IIS 7.0 - 21

21. Click on Allow User … in the Actions pane

How to Setup User Authentication in FTP 7 on IIS 7.0 - 22

22. The Allow User … dialog box now shows both types of users, Windows & IIS Manager. In our case we are going to click the Select … button.

How to Setup User Authentication in FTP 7 on IIS 7.0 - 23

23. In the Users dialog select the user, (Gomer in our case) and click OK.

How to Setup User Authentication in FTP 7 on IIS 7.0 - 24

24. Click Ok to continue and add the user to IIS Manager Permissions.

How to Setup User Authentication in FTP 7 on IIS 7.0 - 25

25. Now we have to add an authorization rule, so let’s choose the site again in the connection pane, then FTP Authorization Rules, in the central pane.

How to Setup User Authentication in FTP 7 on IIS 7.0 - 26

26. Select Add Allow Rule … in the actions pane.

How to Setup User Authentication in FTP 7 on IIS 7.0 - 27

27. The Add Allow Authorization Rule dialog box is next, so select Specified users and type the users’ names in, separated by commas. Place a check next to either or both Read/Write permissions, and click OK.

How to Setup User Authentication in FTP 7 on IIS 7.0 - 28

We have now setup this site to use both types of users Windows and IIS Manager Users. You can use these in conjunction with each other or completely independent of the other — all depending on the needs of your organization.

TrainSignal trial

Ready to test your skills in ASP.NET? See how they stack up with this assessment from Smarterer, the newest addition to the Pluralsight family. Start this ASP.NET test now.

0
 in IIS

Comments