Security

Ask something
Discussion Locked

Securing FTP access in IIS 4.0

0 helpful
7 replies

by pkellett

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I want to set up IIS so that I get a secure connection to a users home directory.
At the moment, I have ftp set up so that a user logs on to the ftp site and by using their alias get access to their home directory.
However, ftp is unencrypted and when I specify the home directory share for the virtual directory file location, I have to specify a username and password for this resource.
I would prefer that IIS passed through the username and password to the network resource to tighten up security.
I'm also going to have to find a way of automatically creating a virtual directory for all of the 500+ user accounts in our organisation. Can this be automated.

Any help with this would be greatly appreciated.

Regards,

Paul Kellett

7 replies

by philanderson

An important setting in IIS is 'Allow Only Anonymous Connections'. If you have an FTP server you might want to turn this option on. This setting will prevent users from logging on to the FTP server with their usernames and passwords. This is a wise security precaution because usernames and
passwords are transmitted in clear text and are thus easy to intercept.
"I'm also going to have to find a way of automatically creating a virtual directory for all of the 500+ user accounts in our organisation. Can this be automated?"

by pkellett

The whole idea of having logins would be that the user went to their own home directory. Using anonymous would mean that I'd have to open up the whole ftp site which is unacceptable. So, to elaborate you go to ftp://mysite and type in your usernameand pass and automatically are mapped to ftp://mysite/myusername/

by brian_e

You've already pointed out that FTP userid's and passwords are sent in the clear.

Your options are:
-Use a different FTP server and FTP client that supports a secure connection. This would no longer be "FTP"
-Use IPSec to create an encrypted communication link which you could now start FTP.
-Use HTTPS (HTTP w/SSL) for browsing directories. Not elegant, but atleast it would be secure (similar to the idea of using IPSec).

Regards,
Brian

by brian_e

Another idea, depending on the client..

Use NET USE commands. This would use the file and print sharing of Windows. The network resource would appear as a drive letter on the clients machine.

Password hashes are sent encrypted. However, be warned, this opens up a whole new can of warms you must be aware of.
-Opens other vulnerabilities of the file and print sharing.
-Passwords can be sniffed and brute force decrypted.

Regards,
Brian

This discussion is closed to new replies.