I'm setting up a Windows Server 2008R2 cloud server on rackspace and ftp will be used by only a few users. Any thoughts on using Filezilla vs IIS 7.5?

  • 2
    The one you are most familiar with and are best able to configure correctly and securely is the correct one to use. – Rob Moir Oct 3 '10 at 21:33
  • And in the case I am not familiar with either? – Tone Oct 4 '10 at 13:22
up vote 7 down vote accepted

Depending on the server's purpose, I would eschew the native IIS FTP server in favor of a third-party server not tied to the server's authentication system. The major advantage here is that you can sandbox the accounts, and any security vulnerabilities in either the FTP server or Windows file system security are relatively decoupled. Moreover, the third-party FTP process is a little less privileged, since it isn't a core service provided by Microsoft.

A case where this would be the preferred solution would be an IIS web server where one user in each department is in charge of updating the departmental website. A case where it would not be the preferred solution is when every user in the organization has their own web space, in which case the advantages of using the central directory system would probably trump the slight security advantage.

Well, the advantage of using Filezilla is that you have FTPS capability, so that nobody would be able to fish your passwords or content as a man-in-the-middle attack. Also, as an additional option, if you run the "NULL FTP Server" you could run a single port SFTP server on port 22.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.