If you’re like me and constantly have to burn discs, package them, and then ship them or perhaps you always have to carry around a hard disk with you in case you need to access files and documents, then setting up an actual FTP server of your own is the way to go.

It’s a fairly straightforward process and extremely beneficial, considering the cost of materials, time for shipping, etc. that you have to deal with now. Why take up those extra resources when you don’t have to?

What is FTP?

FTP stands for File Transfer Protocol and is used to exchange files on the Internet. An FTP server allows requests for files via FTP to be accessed. As outlined by the RFC, one of the main objectives of FTP is to promote the sharing of files and to transfer data reliably and efficiently.

So even if you’re just sharing music, photos, or any type of data really, an FTP server can provide access to the data quickly and efficiently.

Choosing an FTP Server Product

There are several free versions of FTP products available on the market including FileZilla, Golden FTP, Xlight FTP Server and others.

For today’s demonstration, I chose Serv-U FTP because it has an easy to use interface and good reviews. It also has a free 30 day trial which allows you to test all of the features and options that they have to offer.

Even if you don’t want to spend money on an FTP Server and want to use a free product instead, I would still suggest installing the Serv-U trial and taking advantage of the 30 day free trial, especially if you’re new to FTP.

Trust me, it’s much easier to learn how FTP servers work on a product that has a good interface and is easy to use then it is on a free option that has limited support and tricky interface. At least that was my experience.

Setting Up An FTP Server

1. Start off by downloading Serv-U FTP.

2. The installation is really straightforward but let’s run through it anyway.

3. It starts off with your typical install information such as language, install location, and agreement not to sue after you computer crashes … just kidding, it’s all the usual stuff you see with any other software install.

4. Before you finish the install you have one more chance to review all of your setup info to make sure it’s correct. If no changes are needed, simply click Install.

5. After the install you’ll see one last message from the setup wizard that gives you the option of starting the Serv-U Management Console. Select the option if you’re ready to continue and click Finish.

6. Once the install is complete you’ll be prompted to answer some questions regarding your FTP server.

The first question will be regarding a domain name. If you don’t have one available you can create one at DynDNS.com — it’s free. (More info on domain names and DynDNS.com below.)

7. Next are the protocol and ports selections; you can leave the settings as they are.

8. For step 3 of 4 on the Domain Wizard select All Available IP Addresses and click Next.

9. The last step is in regards to encryption, and for this I would suggest using the server settings (the first option) which is the most secure options, unless you have a reason to choose otherwise.

10. After this, your setup is complete.

Setting up a Domain

To make your FTP available on the Internet you will have to setup a domain name.

What I did was go to DynDNS.com and set up a free account with a custom address that I use for my FTP server. You have the ability to create a domain name something like:
myftp.homeftp.net. You then use this name to connect to you ftp server.

It’s free and simple.

Setting Up Your Router

Now that you have a domain name for you FTP server, you will have to setup your router so that it forwards all incoming requests to the computer that is setup as your FTP server.

First thing is determining the computer’s IP address. You need this so that the router knows where to send the FTP request to.

To do this, go to Start/Run and type in cmd.

In the command prompt type in ipconfig to find your IP address.

I recommend setting up your computer with FTP server with a static IP address so that it does not change. For more info on this refer to this article on configuring a static IP address in Vista.

Next, we turn our attention to the router. What you want to do is connect to your router by typing in http://192.168.1.1 into any Internet browser. I have a Linksys router, and other routers may vary slightly but the basic concept is the same.

Now, type in the username and password for your router; if you don’t know it, look on your router, it should have a default one.

In the setup tab of my router, there is a setting for DNS Service where you can put in the domain name, username and password for your DynDns Domain account.

The last thing you want to do is go to port forwarding and enter the port number you are using (should be 21) and then the IP address of the machine with the FTP server.

Creating FTP Users

After your initial FTP Server install, a wizard will come up for creating FTP users.

Again, it’s very straightforward; enter the username, password, directory access (what files they have access to), and finally read and read/write access.

In steps 3 and 4 you select what directory your users can access as well as read only or full access rights.

The User Wizard guides you through the easy 4 step process and explains everything along the way.

In the global settings of Serv-U you can create more users, user groups and configure a lot of options, like access and download limits, IP restrictions, you can also monitor connection, server activity and much more. in other words, Serv–U gives you a lot of flexibility.

Testing Your New FTP Server

Now let’s make sure your new FTP server works.

If you have the capability to go to another computer on a different network, try it out with one of the free FTP clients like Filezilla or Fireftp. Just test out the usernames and passwords you created and make sure you are able to get to the directories you’ve allowed access to as well as read and write permissions.

Obviously, you will want to be careful who you give these out to as well as knowing they will have free range to the information on our computer. If the FTP server is for personal use, you should be fine but be careful in a corporate setting.

Last Thing: Security

This part is optional and beyond the scope of the article, but additional security is always a concern with FTP as well as any data transmitted over the web.

You may want to utilize Serv-U’s ability to allow secure connections (SSL), which will encrypt passwords and the data that is transmitted. In the Serv-U settings under Limits and Settings you’ll find the option to allow SSL and configure encryption settings.

Or if you’re using a different FTP server, make sure to configure your security settings accordingly.

 
That’s it for setting up an FTP server! Now you can sit back and enjoy the easy exchange of data from anywhere.

In this article we will cover adding additional layers of security to your FTP sessions.

Setting Up FTPS: FTP Over SSL

Most administrators only worry about keeping data secure once it is on one of their servers. As the bad guys get more sophisticated every day, the need to keep data secure during transmission is no longer only for the realm of e-commerce sites.

By using SSL you can secure your FTP transmission from point to point to guard against interception of the data. There are several things that need to be done before we get to that point so let’s get started.

How to Setup a Public Key Server Certificate

Our first order of business is to setup a SSL certificate on the IIS server. Now if you have experience with using SSL on a website for e-commerce or other uses, you know that you can issue this yourself or you can pay a 3rd party service to issue one.

The benefits of the 3rd party are having their assurance that the person who uses the certificate is who they say they are, but in almost all cases this will not be necessary for FTPS use.

For this article I am going to issue a Self-Signed Certificate for our test server to use.

1. Open IIS Manager

2. Select the server you want to manage and then double click on Server Certificates

3. In the actions panel select Create Self-Signed Certificate

4. In the dialog window type in a the name you want to use for the certificate, it can be whatever you wish, let’s use FTPSTEST and then click OK

After a few seconds the dialog window will close and you will be able to see the self-signed certificate in the center window of the IIS Manager

How to Enable a FTP Site for SSL Usage

Now let’s go ahead and enable SSL on the FTP site.

If you want to know how to setup a FTP site refer back to either the article on installing FTP 7 or setting up User Authentication in FTP 7. I’m going to use the FTP site we already setup for the other articles, so please review them if needed.

1. Open IIS Manager

2. Select the FTP site you want to setup SSL for in the connections pane and then double click on FTP SSL Settings in the center pane

3. In the center pane, you can now select the certificate you created in the SSL Certificate dropdown

4. Under SSL Policy you have several options depending on your needs. For this walkthrough choose Custom and click on Advanced. The options are explained below:

• Allow SSL connections – Accepts SSL connections but does not require them
• Require SSL connections – Forces the client to use SSL by requiring it to establish a connection
• Custom – Allows you to define combinations of requirements for the SSL connection

5. In the Advanced SSL Policy dialog windows we can make some specific requirements for both the Control Channel and the Data Channel

Control Channel has 3 options available:

• Allow – Allows encryption of the control channel but does not require it
• Require – Requires encryption of all aspects of the control channel
• Require only for credentials – Requires the encryption for transmitting username/password, but is options for the rest of the control channel data

Data Channel also has 3 options available:

• Allow – The client can choose to encrypt or not encrypt the data
• Require – Client is required to trans it the data over SSL
• Deny – Server will refuse connection for the data stream over SSL

6. I am going to set the Control Channel to Require only for credentials, and the Data Channel to Allow.

This will ensure that all login credentials are encrypted leaving the rest of the option up to the client. Click OK

7. Next go ahead and click on Apply in the actions pane

This has now configured this FTP site to use SSL during its transmission of data. Now a quick note about FTP clients, not all FTP clients support FTPS so make sure your users have one that does before you apply these settings.

Warning: As of this warning the native command line FTP that comes with Windows does NOT support SSL so if you have scripts that you use for FTP do not apply these settings.

How to Configure User Isolation in FTP 7 on IIS 7

Another option to help secure data on a FTP server is to have the users login to isolated directories that only they have access to. This can have several benefits beyond security, also making it easy to enforce user quotas and file/user administration.

Again this example will assume that you have a FTP site and user authentication already setup. If you need help with that please see the earlier articles in this series.

1. Open IIS Manager. Choose the FTP site you want to enable isolation for and then double click on FTP User Isolation in the center pane.

2. In the FTP User Isolation window you will have the following options to choose from:

• Do Not Isolate Users. Start users in:
  • FTP Root directory – All FTP sessions will start in the root directory for all users
  • User name directory – If a physical/virtual directory with the username exists the user will start there, if not they will start in the root directory

• Isolate users. Restrict users to the following directory:
  • User name directory (disable global virtual directories) – This option isolates the users in the physical or virtual directories that match their usernames. The FTP user will not have access to global virtual directories with this option.
  • User name physical directory (enable global virtual directories) – With this option the users will be isolated to the physical directory that matches their username. The FTP user would have access to global virtual directories.
  • FTP home directory configure in Active Directory – This option places the FTP user in the directory set in the Active Directory account for that user.

I am going to set the Isolation to User name physical directory (enable global virtual directories) and click on Apply

The site is now setup for user isolation that can be used with Basic Authentication or IIS Manger Users. All that is left is to create the home directories for the users.

How to Create Home Directories for FTP Users

For the server to correctly place FTP users in their isolated directories they have to be setup in a certain way for the server to find them correctly.

The ways they are setup are based on whether they are domain users or local/IIS Manager Users. Here are examples of the correct way to set them up:

• Local Windows or IIS Manger User: %FtpRoot%\LocalUser\%UserName%
• Windows Domain Accounts: %FtpRoot%\%UserDomain%\%UserName%

Note: %FtpRoot% is the root of the FTP site that you are managing.

Summary

In this article we discussed two ways that you can make the FTP data on your server more secure both in storage and during transmission.

By using FTPS you can make sure your users only connect securely to the FTP site. With user isolation you can keep your users files separated for security and administration.

You can use both of these measures at the same time or independent of each other, whichever best suits your environment.

For this article I will assume that you already have Server 2008, IIS 7, and FTP installed and ready to go. Now let’s secure your FTP servers.

User Authentication in FTP 7 on IIS 7

In our first article on FTP, I showed you how to install and then configure an anonymous public site. This allowed anyone to get the files located in those directories.

While this is great for a certain type of site, if you require greater security you can setup authentication for your FTP site. We are going to look at two types of user authentication, one using Windows users and another using IIS Manager authentications.

Windows Users FTP Authentication

This type of user authentication allows the FTP site to use the local Server user accounts/groups for access to the FTP site.

This example assumes you already have a user created for this purpose and given the account access to the FTP directory; we are using the account FTPUser.

1. Start by opening IIS Manager

2. Right click on Sites, and then click on Add FTP Site …

3. Fill in the site name and path to the directory that will hold the files. We are using WindowsFTPuser.com and C:\inetpub\privateftp for our example. Click Next when done.

4. Choose an IP for this FTP site to use, and change the radio button to Allow SSL. Leave the rest of the setting alone for now.

5. In this window we will specify what users are allowed access and Read/Write permissions will be assigned to those users.

Check the box next to Basic, set the dropdown to Specified users, under that type in the user name (in our case FTPUser), and check Read & Write. Click Next after you enter all the information.

6. That ends the FTP site wizard, if you want to add or remove users after the initial setup, in the IIS Manager click on the site you want to manage and then click on FTP Authorization Rules.

7. In this pane you can select to Add Allow Rule …, Add Deny Rule …, and Remove. This allows you to manage access to your ftp site through basic Windows authorization.

With this configuration only those users assigned to the FTP site will be allowed access. Please note that you can also use Group permissions the same way.

IIS Manager Authentication

For a long time compared to *nix implementations of FTP, Windows was sorely lacking. One of the biggest hurdles was the fact that if you had site managers who wanted to give access to certain users there would have to be a corresponding account setup for them on the local server. Not the best situation from a security or administration standpoint.

With the release of FTP 7 and IIS 7 this has been corrected by the use of IIS 7 Management Service. In this example, I’m going to setup the service and apply the users to the domain we setup earlier.

1. We have to grant special permissions to the Network Service to be able to use this Service so open up a command prompt.

2. Type the following:

CACLS “%SystemDrive%\Windows\System32\inetsrv\config” /G “Network Service”:R /E

CACLS “%SystemDrive%\Windows\System32\inetsrv\config\administration.config” /G “Network Service”:R /E

CACLS “%SystemDrive%\Windows\System32\inetsrv\config\redirection.config” /G “Network Service”:R /E

Now we have to give rights to the Network Service to the root FTP folder, in our instance this is C:\inetpub\privateftp. When you run this command replace the directory with your own.

3. Open Command Prompt

4. Type the following:

CACLS “%SystemDrive%\inetpub\privateftp” /G “Network Service”:C /T /E

Next we need to install the IIS 7.0 management service on the server.

5. Open Server Manager

6. Open the Roles, find the Web Server (IIS) role, and click on Add Role Services.

7. In the Select Role Services window scroll down till you find Management Service, if it is unchecked then place a check mark next to it and click Next.

If there are any required features that also need to be installed you will be prompted to install those also.

8. Next you will have a summary screen of everything that is going to be installed, click Install to start the process.

9. The next window will show you the progress of the installation process.

10. Installation Results window will appear when the installation is finished, click on Close when done.

11. Open IIS Manager

Select the server in IIS Manager; in our case, TSTEST, and scroll down in the center pane to Management Service and click on it.

12. In the Management Service pane, look for the Identity Credentials box and select Windows credentials or IIS Manager credentials, then click Apply.

13. In the connections pane select the server you are working on, and double click on IIS Manager Users.

14. Click on Add User … in the Actions pane.

15. Now you will create a user account that can be used, in our case I am going to add Gomer and enter a password for that user.

16. You will now see that the user is created and you can do some limited administration in this panel for those users, including Disable User and Change Password.

17. Now click the site you want to configure to use IIS 7 Manager Authentication in the connections pane, choose FTP Authentication in the center pane

18. Click on Custom Providers in the action pane.

19. In the Custom Providers dialog window place a check next to IisManagerAuth, then click Ok.

20. Now let’s add the user we created earlier by selecting the FTP site in the connections pane and then select IIS Manager Permissions in the center panel.

21. Click on Allow User … in the Actions pane

22. The Allow User … dialog box now shows both types of users, Windows & IIS Manager. In our case we are going to click the Select … button.

23. In the Users dialog select the user, (Gomer in our case) and click OK.

24. Click Ok to continue and add the user to IIS Manager Permissions.

25. Now we have to add an authorization rule, so let’s choose the site again in the connection pane, then FTP Authorization Rules, in the central pane.

26. Select Add Allow Rule … in the actions pane.

27. The Add Allow Authorization Rule dialog box is next, so select Specified users and type the users’ names in, separated by commas. Place a check next to either or both Read/Write permissions, and click OK.

We have now setup this site to use both types of users Windows and IIS Manager Users. You can use these in conjunction with each other or completely independent of the other — all depending on the needs of your organization.

Completely rewritten from the ground up the FTP service incorporates new features, security, & deployment options for FTP on Server 2008. The following are some of the improvements you will find in this release:

• Integration with IIS 7.0 – If you have used the FTP service that ships with Server 2008, you know that it was the same as the one that shipped with Server 2003, and you were even forced to install the management console for IIS 6 to manage it. With this release it has an updated administrative interface; it removes the use of the IIS 6 metabase and replaces it with a configuration store based on .NET XML-based *.config format.
• Secure FTP Service – Now you can use SSL to secure your FTP service.
• IPv6 Support – Forward looking for support when the conversion to IPv6 takes place
• Improved FTP Logging – Enhanced to include unique tracking for FTP tracking and includes all FTP related traffic with detailed FTP messages in the logs.
• Authentication for Non-Windows Accounts – Added support for Web Manager authentication and ASP .NET Membership authentication, allowing webmasters to use non-windows accounts to authenticate FTP users.
• Support for Virtual Hosts – Now FTP is available for virtual sites hosted on same IP

FTP Publishing for IIS 7 Requirements

The following requirements need to be met before you install the new FTP service:

• Must be using Windows Server 2008
• IIS 7 must be installed – See installing IIS 7 if you need help
• Must install the FTP service as an administrator
• IIS 7 administration tool installed to manage the service using the IIS 7 interface
• The FTP service that shipped with Server 2008 MUST be UNINSTALLED.

Download Microsoft FTP Publishing Service for IIS 7.0

Download the correct version depending on the server version you are using:

• 32-Bit Installation Package
• 64-Bit Installation Package

How to Install FTP for IIS 7

Ok, we got that all out of the way let’s go ahead and get our hands dirty with the actual installation of the service and take it for a test spin.

1. After download go ahead and navigate to the directory and double click the MSI file. After a second you will get the following Welcome window, click Next to move on

2. The License terms are up next, go ahead and place a check next to I accept the terms in the License Agreement and click Next

3. No typical setup for the power users of FTP! Custom setup is the only option and this screen shows you your options for install.

The only one I can really see as being option is the Managed Code Support, if you would be using any kind of code to work with the FTP service. In this instance we will install everything, by clicking Next.

If you are worried about disk space you can check what you have available by clicking Disk Usage. The total space required by the full install of this service is 4387KB.

4. The moment of truth! Click on the Install button to start the installation of the FTP service.

5. The install process will start and check that your server has all the requirements.

If one of the requirements is not met you will get a window that tells what service is missing and where to go to install it.

6. At the end of the setup routine you will see the following screen, which also has access to the release notes. Click on Finish, to complete the install.

That completes the install instructions for FTP Publishing Service for IIS 7. Let’s take a quick look at what it takes to configure a new FTP site.

How to Create an Anonymous FTP Site

Anonymous FTP sites are useful when you have files that you want to distribute to the public via FTP and do not require any kind of login or security.

1. Start Internet Information Services (IIS) Manager

2. Right click on Sites, and left click on Add FTP Site. You can also click on Add FTP Site in the Actions pane.

3. Now add a FTP site name and a file location for the public files. In this case I will use TSTPublicFTP.com and created the directory publicftp under C:/inetpub, but you can place the files in any directory.

4. Choose an IP address or the default All Unassigned, leave the virtual host space blank, you can leave the Start FTP site automatically checked, SSL Certificate can be set at Not Selected, and the radio button set to Allow SSL, click Next to continue.

5. The next window lets you set the access rights through the FTP service. In our instance we are going to check the box next to Anonymous in the Authentication box.

Set the dropdown to Anonymous users and check the box next to Read rights. These settings will allow all anonymous users to connect to this site with Read-only rights.

Click Finish to continue.

6. After a short pause you will be able to see that the FTP site was added to the IIS Manager console, and can be managed from there.

In this article we have installed Microsoft FTP Publishing Service for IIS 7.0 and configured a public anonymous access FTP site for users to connect to.