Windows 2000 FTP for uploading...

  • Thread starter Thread starter George Ojeda
  • Start date Start date
G

George Ojeda

G'day,

I am wanting to use Windows 2000 Server's built in FTP server to accept
incoming files from a variety of users who are external to my network (in
other words, they are not domain users and have no business being on my
network outside of uploading files to my ftp server). The uploaded files
should be deposited into a particular directory on my ftp server (let's call
it \incoming) and the people uploading those files should only see this one
directory. Uploaders should not be able to see or list the other
directories on my FTP server, which is reserved for domain users.

This is how I would like my FTP to function...

ftproot
|
- documents
|
- photos
|
- utilities
|
- incoming <- uploaders should only be able to see this directory when
they log on, all others should be invisible to them
|
- quicken accts
|
- etc
|
- etc

The FTP site, as it is now, works fine from the internal network and from
the Net. I can create users, authenticate, and they have access to the
site. But essentially I want to be able to have more granular control and
create "classes" of FTP users, where some have access to all directories and
some only have access to a specific directory or directories (as in the
uploading example above).

I do remember achieving this years ago after a lot of trial and error, but I
forgot how to do it. I recall just using user account, group accounts, and
NTFS permissions to achieve the effect.

I know there are ways of configuring the FTP server so that when the user
logs on, the only thing they see is a home directory (as seen in
http://support.microsoft.com/kb/201771/EN-US). Would I use this method? Or
is there another way? It is really important, for me, that when an uploader
send me something, that he has zero priviledges to anything on the server
access the \incoming directory.

Regards,
George
 
George,

The method you mentioned via the Web link is fine however I would take an
additional step concering the incoming directory.
Due to the security risks involved with FTP, I would create a separate
partition for the incoming directory. If by any chance you get hacked where
a hacker starts creating directories using reserved system names such as
COM1, AUX1, LPT1, etc... You would be able to simply delete the partition
and recreate it again, then you'd be back in business. Otherwise you'll be
going crazy trying to delete those directories. FYI, I've only been able to
delete them successfully about 50% of the time.

SGB
 
Open Internet Services Manager snap-in, set permissions on the \incoming
directory to read,write, and browse. All other directory permissions should
be read only. Also make sure the \incoming directory has the
iusr_machinename account assigned to it with write permissions. Create a
partition solely for this directory as the other gentleman had suggested.
 
Back
Top