Solved

IIS7 FTP default folder

Posted on 2016-09-07
8
70 Views
Last Modified: 2016-09-23
In previous versions of IIS (before 7), you could create a Virtual directory under your FTP site w/an alias the same as your user. The user would then land in the physical dir' specified in the Virtual directory on Login.

This does not seem to work for IIS7.  You can find instructions on how to enable user isolation, but I already have several user accounts built and working on this machine and I don't want to go back and re-work those accounts/projects.

How can I get the old method of creating a virtual directory and having the user account w/the same name land in its physical path on login to work ?

Thanks
0
Comment
Question by:sidwelle
  • 4
  • 4
8 Comments
 
LVL 26

Expert Comment

by:Dan McFadden
Comment Utility
IIS' FTP Service functionality with virtual directories functions as it has in previous versions.  The functionality has not changed since IIS6.  How you configure it in 6 and 7 is essentially the same, the configuration has changed under IIS8+

Here is how I setup an IIS FTP Service on IIS7 & greater...

Assumptions:
0.  we are talking about IIS7 without the out-of-band FTP v7.5 service installed
-----  if the this is IIS7 with FTP v7.5 installed, the IIS Manager process is a bit different.
1.  the ftp site will be called ftp.mycompany.com
2.  there is a second partition available on the IIS server
2a.  if there is only a C: drive, substitute C: for D:

On the Local IIS Server:
1. create a group called "ftp-mycompany-com_Read"
1a.  add all Domain User Account (or local user accounts) that require login access and Read-Only to the FTP Site
2. create a group called "ftp-mycompany-com_ReadWrite"
2a.  add all Domain User Account (or local user accounts) that require login access and Read&Write access to the FTP Site

In the file system:
3.  On the D: Drive, create a directory called webapps
4.  under "webapps," create a directory called "ftp"
5.  under "ftp," create a directory called "ftp.mycompany.com"
5a.  In the NTFS permissions for the directory "ftp.mycompany.com," grant:
5a--  the group "ftp-mycompany-com_Read" Read permissions on this directory as all subdirs/files
6.  under "ftp.mycompany.com," create the following directories
6a.  "_blank-root"
6a--  it is my not so humble opinion, that no one should ever write into the root of an ftp site. Users are only granted READ permissions (at the NTFS level and IIS FTP level) to traverse the root if they must.
6b.  "users"
6b.--  In the NTFS permissions for the directory "users," grant:
6b.----  the group "ftp-mycompany-com_ReadWrite" Modify/Change permissions on this directory as all subdirs/files
7.  under "users," create all the required user named directories
7a.  for example, create a directory called, "jsmith"

* At this point, IIS only sees an empty root directory
** At no point should the "users" directory be directly visible to the FTP Site, this would defeat the purpose of this config

In IIS 6.0 Manager (FTP Service v7.0 is basically IIS 6 FTP):
8.  create a new FTP Site, name it "ftp.mycompany.com"
9.  add a description, Next
10.  select a specific IP address to assign to the FTP Service (no "All Unassigned"), Next
11.  select "Isolate Users", Next
12.  select the directory created in step 4a (D:\webapps\ftp\ftp.mycompany.com\_blank-root), Next
13.  select only "Read" permissions, Next
14.  on the newly create FTP Site, update the following settings:
14a.  right-click the site and select Properties, enable logging
14b.  under Logging Properties General Tab, select daily for new log schedule, user local time for rollover, set the log file directory
14c.  under Logging Properties Advanced Tab, select ALL fields to be included in the logs.  OK out.
14d.  since there will be no anonymous access, uncheck "Allow anonymous connections" under the Security Accounts tab.
14e.  under Messages tab, modify the banners if necessary
14f.  under Home Directory, switch the directory listing style to UNIX (just my preference)
14g.  under Directory Security tab, leave as is

15.  right-click the newly created FTP Site, select "New" and "Virtual Directory"
16.  give the Virtual Directory an alias from step 5a, name it "jsmith"
17.  select the path of the Virtual Directory from step 5a (D:\webapps\ftp\ftp.mycompany.com\users\jsmith), Next
18.  select both read and write perimssions for this Virtual Directory, Next

As a test, a user account that is a member of either the groups created in steps 1 & 2, should be able to login and automatically land in their respective named Virtual Directory.

If this is really IIS 7.5 or greater, the step in IIS Manager are somewhat different.  Below are links for IIS7 and IIS7.5+...

Links:

Default FTP service = https://www.experts-exchange.com/questions/21866201/home-directory-inaccessible-unable-to-login-FTP-server-on-IIS-6-0.html
IIS 7 w/ FTP 7.5 = http://www.iis.net/learn/publish/using-the-ftp-service/configuring-ftp-user-isolation-in-iis-7

PS:  it would be helpful to which FTP Service is installed.

Dan
0
 

Author Comment

by:sidwelle
Comment Utility
I appreciate you taking the time to type all that up, but I guess what I am looking for is to try and mix the settings.
I need for some accounts to land in the root and others to land in specific folders.

We already have several projects setup and working, so I was hoping to try and not go back and change the "Isolation" setting on the ftp service, just cause some accounts to land in specific folders.

Thank You.
0
 
LVL 26

Expert Comment

by:Dan McFadden
Comment Utility
First, what is the version of the FTP Service that is being used?  Functionally it makes a big difference.

In general, in FTP Service 7.5+, if you configure the "Do not isolate users.  Start users in:" option to go into their User name directory, and there is no user named directory.. those users fall into the root.

In general, mixing and matching is not allows an option.  Often it is either one way or the other.

Another reference link: http://support.orcsweb.com/KB/a338/create-an-iis-75-ftp-site-windows-server-2008-r2.aspx

Dan
0
 

Author Comment

by:sidwelle
Comment Utility
"... In general, mixing and matching is not allows an option.  Often it is either one way or the other...."

That's what I need to know, a lot of server techs here just load "Server-Zilla", but I was trying to stay away from 3rd party software.

Help from the IIS Manager...
   Internet Information Services (Version 7.5.7600 ...)
0
Get up to 2TB FREE CLOUD per backup license!

An exclusive Black Friday offer just for Expert Exchange audience! Buy any of our top-rated backup solutions & get up to 2TB free cloud per system! Perform local & cloud backup in the same step, and restore instantly—anytime, anywhere. Grab this deal now before it disappears!

 
LVL 26

Expert Comment

by:Dan McFadden
Comment Utility
So.  I can update the steps to account for FTP 7.5.  But if you desire a mix and matc setup, you can deploy another FTP site in IIS with isolation enabled and leave the previously configured FTP site running.

You could also try turning on isolation and then, for accounts that should land in the root directory, just configure that accounts home directory to be the root.  As an option.

Dan
0
 

Author Comment

by:sidwelle
Comment Utility
"... configure that accounts home directory to be the root."

How do you do that, I thought w/Isolation, your clients ended up in a folder named after the login ?
Like its hard coded into the ftp service ?

Thanks
0
 
LVL 26

Accepted Solution

by:
Dan McFadden earned 500 total points
Comment Utility
Just create a virtual directory and point the path to the root directory.

Dan
0
 

Author Closing Comment

by:sidwelle
Comment Utility
Dan, I will test and get back to you.

Thanks for the help and sorry for leaving this question open so long.
0

Featured Post

Find Ransomware Secrets With All-Source Analysis

Ransomware has become a major concern for organizations; its prevalence has grown due to past successes achieved by threat actors. While each ransomware variant is different, we’ve seen some common tactics and trends used among the authors of the malware.

Join & Write a Comment

Possible fixes for Windows 7 and Windows Server 2008 updating problem. Solutions mentioned are from Microsoft themselves. I started a case with them from our Microsoft Silver Partner option to open a case and get direct support from Microsoft. If s…
A safe way to clean winsxs folder from your windows server 2008 R2 editions
This tutorial will give a an overview on how to deploy remote agents in Backup Exec 2012 to new servers. Click on the Backup Exec button in the upper left corner. From here, are global settings for the application such as connecting to a remote Back…
This tutorial will walk an individual through the steps necessary to configure their installation of BackupExec 2012 to use network shared disk space. Verify that the path to the shared storage is valid and that data can be written to that location:…

763 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

7 Experts available now in Live!

Get 1:1 Help Now