Separate Anonymous Access User to prevent FTP browsing?

From: Sparky Polastri (jafiwam_at_MuNGEDyahoo.com)
Date: 02/20/04 

Date: Fri, 20 Feb 2004 16:33:31 -0600

I have several virtual webs running in the same FTP root folder. Users
update their sites via FTP using accounts that have the folder name (to dump
them there) and write access to only their own folder tree.

With this setup, a user can authenticate with their FTP account, browse from
their folder to the FTP server root and back down to other FTP based web
sites to view and list files. Though files are read only at that point,
some users consider it a security problem as they tend to have web pages
that are not "published" (linked to) or leave things in their sites they
don't want others reading. (The security by obscurity model.) This occurs
even if the virtual WWW web requires a password for HTTP access.

This behavior seems to be the norm among FTP web sites sharing the same IP
on IIS.

Despite being instructed that all files in a web server are publicly
available and they should take pains to make sure information does not leak
out that way, the users still complain about it.

I was looking at the "anonymous user access" feature and wondered if the
following plan is feasable:

- Make an account used to edit the FTP site (folder) for each user to edit
with read/write access.

- Point the WWW virtual web at that same folder.

- Make a new account and add it to the "anonymous user access" account for
that virtual web, then give that account read only access to the folder tree
that contains that web.

The net effect should be there are no shared accounts with even "read"
access to other folders in this directory tree under the root of the FTP
server (i.e. webmasters can't browse each other's sites).

Has anybody done this and obtained the proper result? (i.e. no browsing
across FTP webs)

I do not mind the extra steps to go through to do the task, but do not want
to mess up the permissions on a live web server without a little background
to get started with.

Thanks!

Relevant Pages

  • RE: FTP Accounts
    ... Create the new account, give them NTFS access to the ftproot folder and any ... when they first logon to the FTP server. ... | Content-Class: urn:content-classes:message ...
    (microsoft.public.inetserver.iis.security)
  • Re: Windows 2003 Error need help
    ... A 3rd party FTP may be more secure. ... First you would want to rename your AD administrator account to something else, then create an administrator account in the domain, but only leave it in the Guest group, then disable the account. ... Thn create a user account on ServU called "administrator" on ServU, leave the password blank, create ab empty folder, then configure the administrator user account you created to use this emtpy folder as its home folder, then configure permissions to only Read. ...
    (microsoft.public.windows.server.networking)
  • Re: Secure FTP site
    ... Users must then provide a valid local account with ... For remote users to connect to the FTP service, ... You need to grant this right to any other ... the Administrative Tools folder. ...
    (microsoft.public.inetserver.iis.security)
  • Re: My FTP access is very unsecure - advice requested
    ... Do you have security set at the folder level for each user's folder? ... >> search random IP addresses for FTP servers that are open to abuse. ... >> because that account exists to allow anonymous logons to proceed. ... >> There are secure FTP servers available for even less than that - I'm ...
    (microsoft.public.inetserver.iis.ftp)
  • Re: Separate Anonymous Access User to prevent FTP browsing?
    ... folders of all the FTP webs even though they are different roots. ... I think the issue is not the folder level permissions (NTFS seems to keep ... FTP but not open other folders off the root) and the virtual web has it's ... >> them there) and write access to only their own folder tree. ...
    (microsoft.public.inetserver.iis)
Loading