This note contains information on how to install and enable FTP access to a server based on Windows Server 2008 (including R2) using the built-in IIS 7.
In order for Windows to start accepting FTP connections, you need to install a number of components. If you don't have IIS installed - keep in mind that it will be needed.
If IIS Is Not Yet InstalledSo, if IIS (Internet Information Services) is not yet installed - open the "Server Manager" snap-in (Start -> Administrative Tools -> Server Manager), open the "Roles" section and click "Add Role".
We need to add the "Web Server (IIS)" role.
Among the components, find and select the "FTP Server" block and make sure the checkboxes are also set for the "FTP Service" and "FTP Extensibility" components.
That's it, follow the wizard's prompts from here - install IIS - the FTP components will be installed along with it.
If IIS Is Already InstalledIn this case we need to add FTP support to IIS. To do this, open the "Server Manager" snap-in (Start -> Administrative Tools -> Server Manager), open the "Roles" section, find the installed "Web Server (IIS)" role (click on it) and click "Add Role Services".
In the window that opens, select "FTP Server" and make sure the checkboxes are set next to "FTP Service" and "FTP Extensibility".
Continue through the wizard - it will install the FTP services.
Configuring FTPOpen the "IIS Manager" snap-in (Start -> Administrative Tools -> FTP Services Manager).
Next, expand the line with the name of our server and click "Sites". If IIS is already installed and you use it - you know that this tab lets you create sites. But now, if you right-click on this item ("Sites") - you can see another option: "Add FTP Site".
This is exactly the option we're interested in now. So, right-click "Sites" and click "Add FTP Site".
In the window that opens, set the site name and the path to its folder (i.e. the path to the physical folder on the hard disk where the files of this FTP site will be located). Then click "Next".
Next specify the IP addresses at which the site will be available (or leave the default value "All Unassigned" so the site is accessible from all addresses) and specify the port (port 21 is the standard for FTP).
The "Allow virtual host names" option lets you (as with an HTTP server) use virtual hosts (i.e. several FTP sites on one IP, with access to them organized not by IP address but by a DNS FQDN name, e.g. "ftp://my.ftp.site.ru").
In the SSL section, choose the option that suits you. With the default "Require" option you will need to specify an SSL security certificate (which you must create and install in advance), and this option will prevent most regular FTP clients from connecting to this site (since it requires SSL support on the FTP side), while other clients won't be able to work in plain mode. On one hand this is good - information is transmitted far too openly over FTP. On the other hand - make sure you have a modern FTP client for accessing this site.
Or simply choose the "No SSL" option.
The next window and the next questions.
"Authentication".
If you check the box next to "Anonymous", anonymous (non-authenticating) users will get read access to FTP.
Checking the "Basic" box will let registered users get access with higher privileges (write access).
In the "Authorization" section you can specify the authorization type:
a) "Not Selected" - no one has access;
b) "All Users" - in this case all users will have access to FTP with the privileges specified below;
c) "Anonymous Users" - only anonymous users will have access with the privileges specified below;
d) "Specified Users and Groups" - you can list users and groups (including domain ones) in the field below - these users and groups will have access to FTP with the specified privileges;
e) "Specified Users" - you can list only users (not groups) in the field below - these users will have access to FTP with the specified privileges.
Below you can specify what level of access the listed users will have: read, write, or read+write. Yes indeed, Windows has this tricky feature - in its FTP directory you can grant write permission but deny read permission, and it works :)
That is, a user will be able to upload information to the server, but won't even be able to get a file listing.
That's it, click "Finish" - and the site is created. From here you can already connect to the server and poke around in its FTP folder.
Post-configuration.But you may need to change the permissions for the FTP site's directory or other parameters. To do this, click on the line with the site and a control panel will appear on the right side.
Access rights to the site are set through the "FTP Authorization Rules" item.
Authentication modes (anonymous access, login/password access) are changed in "FTP Authentication".
You can change the SSL encryption settings, respectively, in the "FTP SSL Settings" item.
In the "FTP IPv4 Address and Domain Restrictions" item you can create allow or deny entries - which IPs may connect to this site, and which may not.
In the "FTP User Isolation" item you can configure how users will be isolated from one another:
a) FTP Root Directory - all users see all of each other's folders and files, the session starts from the root folder of this site.
b) User Name Directory - all users see all of each other's folders and files, but the session starts in this user's own personal folder (the user can still go up one level and see other users' folders).
c) Isolate users within the bounds of their home directories, with various options (with or without global virtual directories, or even via the Active Directory directory).
That's about it. The panel is quite simple, and you can figure it out in 5-10 minutes.
Comments