Question Locked

Setting up a secure FTP in 2003 server.

0 helpful
11 replies
Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Hi All,

Can anyone tell me the best practice for setting up an FTP server for my work place.

We are getting an increasing number of people sending and receiving large files. I want to try and get people using the FTP more.

At the moment its setup but I'm very worried about it as it appears that someone somewhere is constantly trying to access it using all the passwords and account names under the sun. I can see this from eventvwr.

At the moment its setup on our main server (we only have 2, 40 staff company ish) with a user account setup in AD that our externals use to access the site when they want to download or upload anything. I have denied access to the rest of the folder structures on the server.

How should I set this up to make it secure so it doesn't cause me sleepless nights?

Many Thanks
Gav

11 replies

by Former member

Creating a password protected Personal FTP Server using
Microsoft Internet Information Services 5.x and 6.x

Note: Installation steps apply only to Microsoft Windows 2000, XP Professional, Media Center Edition, Tablet PC Edition or Windows Server 2003. If you are using Windows XP Home Edition you will need to install a 3rd Party FTP server as the components used in this guide are not available on Home Edition Machines. It should be noted that there is a 10 connection limit and a maximum file size limit of 2 Gb in IIS on non Server editions of Windows.
To find a list of 3rd party servers click here.
First of all you would need to create a new limited password protected user
which will be used to logon to the ftp server. In Windows XP you can do this via Users in the control Panel
Next go to add/remove programs, then add/remove windows components from the left bar, an item called 'Internet information services (IIS)' will be listed, select this and click the details button. For an FTP server you only require 'common files', 'file transfer protocol (FTP) service' and 'Internet Information Services Snap-in', click ok and then next (you'll be prompted for your Windows installer CD at this point). If you wish to host web pages you will need common files and the world wide web service item within the details of world wide web service.

After IIS has installed go to administrative tools in the control panel (classic view) and open Internet Information Services.
Expand (Local Computer) and do the same for FTP Sites. Now
right click on 'default ftp site' and view its properties. Click the
security accounts tab and uncheck 'allow anonymous connections'. if you also
wish your users to write to the server click the home directory tab and put
a tick in the Write box. If your using the Windows XP firewall or 3rd Party firewall you will need to open port 21 for to allow users to connect to the server.

The area files will be read and written to on your hard disk is C:\Inetpub\ftproot. The FTP service logs are stored in %windir%\system32\Logfiles\MSFTPSVC1 in the
default configuration. These locations can be changed on the Home Directory and FTP Site tabs of the default ftp site properties respectively.

After reaching this stage it is advisable to visit the Windows Update site as the
Security roll up patches for IIS are fairly important. If you are using Windows XP be sure to have installed Service Pack 1, or Service Pack 4 if you are using Windows 2000 (Users of Windows 2000 and XP please see part 4 of this guide). If you are using Windows Server 2003 and have terminal services also installed, check the properties of the new user you have created for this server and be sure to uncheck ?Allow logon to Terminal Services? on the Remote Access tab, by default this will be checked and enable remote logon which is a security risk.

Part 2: Controlling Server Access:
http://www.mvps.org/marksxp/WindowsXP/IIS/iis2.php

Please post back if you have any more problems or questions.
If this information is useful, please mark as helpful. Thanks.

by philip_calvert

Hi,

Many thanks for the comprehensive reply again. My fiorst post states that i ahve already set up the FTP.

What i was wondering was what the best practices were to secure it. Using the method i have used and you have patsed above the hacker would just need to work out the password and there in.

Any other advice very welcome.

by larryd4

Few questions..

Is this an IIS FTP Server?
Is this an FTP Server only used on your internal network?

by susan2009

Thanks Peconet for your explanation on this topic.

by larryd4

Just saw your original post, its a 2003 Server running IIS and you have the IIS FTP service running, not some other FTP option, correct?

by philip_calvert

Hi,

Yes it is an IIS FTP server
No its used for us to supply and recieve large files from the outside world.

We are a single location company so no need for an FTP internally.

The FTP server at present is on a Domain controller but i could find some old xp cd and stick it on that if thats better.

G

by larryd4

The lockdown tool disables services such as terminal server and other poits of intrusion. I would get it off of your DC and have a stand alone FTP. Especially if it services outside traffic.

by nimmo

I'd be inclined to first move the FTP server off the DC and onto another machine, you have three different options for authentication when using IIS

It all depends on what you want to achieve for example if only domain users are to access this you would isolate users using AD.

If you wish only allow a select number of people from outside the company then select isolate users.

(The trick with this option is that you need to match the username with the user?s folder otherwise when they log in the wont be in their own folder they will have dropped into the parent folder)

Some reference links:
http://tiny.cc/uKvzh
http://tinyurl.com/5nhyk
http://tiny.cc/pYaVo

by bizintelligence

This discussion is closed to new replies.