1

We're using Windows Server 2008 with Active Directory controlling access to a network share. We've setup FTP so that people can access that share from outside (we used to use the PPTP VPN but for various reasons we need to switch to FTP). So far here is what we've managed to implement on the FTP:

-The network share is used as the FTP root (defined as a UNC) and that is working fine.
-AD authentication is working fine (wrong password and you stay out, good password you're in, password management in AD correctly synched with the FTP).
-AD permissions are failing: the AD permissions on the content of the FTP root are ignored: it's either a user only has read or write access, but this applies to the whole FTP root, which obviously isn't suitable since that FTP root is initially our network share and files/folders have different AD permissions depending on people's groups...

Whether we set the permissions through the share OR the FTP management interface, AD permissions are never enforced.

Q1: Is that normal?
Q2: If so what solutions exist to combine AD permissions with FTP on MS server 2008?
Q3: If not, where should I look to fix the configuration?

1st update:
Following MarkM's answer I did the following:
-Set the NTFS permissions on the share (which is also the FTP root) to List folder contents for Domain users
-Set the FTP Authorization Rules to Specified roles or user groups=Domain Users with Permissions=Read (before write was also enabled hence why NTFS permissions were probably overwritten).

I then created 3 folders with the following NTFS permissions:
-folderA: inheritable, nothing else
-folderB: not inheritable, Full control to Domain users
-folderC: not inheritable, no permissions for Domain users

Via FTP, the NTFS read permisisons are properly enforced, however the write permissions aren't:
-folderA: can see the folder, can open it and download it's content, can't upload to it
-folderB: can see the folder, can open it and download it's content, can't upload to it (NTFS write permission is NOT enforced) -folderC: can't even see the folder (NTFS read permission is properly enforced)

Q4: What other settings should I be looking at?

Improve this question
2
  • 1
    Why on earth are you using FTP? It's almost 2012. It's clunky and completely insecure.
    – MDMarra
    Nov 17, 2011 at 17:14
  • 1
    Because our employees travel a lot to developing countries (Rwanda, Burundi...) where the Internet connection is very very very bad. The VPN just sucks with high latency, we're thinking that FTP will help as all they need is a link to the file to download it. I welcome other suggestions. As for FTP being insecure we will enable SSL as part of IIS.
    – Max
    Nov 18, 2011 at 11:39

1 Answer 1

Reset to default
2

Q1
No, that's not normal, unless you have anonymous FTP access turned on in IIS. If you disable this, then access is evaluated based on NTFS ACLs and SMB Share ACLs. Best practices are to give Everyone Full Control on the Share ACLs and control access through the NTFS permissions. I think this might be what's tripping you up. Chances are, your NTFS permissions give Users (or some other widely populated group) R/W at the root of the share. Consider just giving them Traverse Directory and List Folder Contents instead. FTP (and anything else that isn't SMB) ignores Share ACLs. Triple check your NTFS ACLs and make sure that they are in order.

Q2
This is natively supported

Q3
See above answsers.

Improve this answer
3
  • I've unchecked the write permission option in the FTP Authorization Rules which seems to have resolved the issue whereby FTP users had full control over the whole share. It looks like NTFS read permissions are properly enforced, but now I can't write to any directory. Please have a look at my update and advise further if you can.
    – Max
    Nov 18, 2011 at 12:48
  • @user64204 You are misunderstanding. You should allow FTP read and write and turn off anonymous FTP if it is on. This is pretty clearly an NTFS permission problem. Instead of posting what you added to the ACLs, can you please post the entire ACL for each folder that you're having problems with? Posting just what you changed isn't going to help, since you were experiencing the issue before you changed anything.
    – MDMarra
    Nov 18, 2011 at 13:34
  • You were right, everything seems to be working fine with both read and write FTP permissions enabled. Anonymous authentication was always disabled. It looks like I may not have tested properly and started getting confused. Latest tests are conclusive.
    – Max
    Nov 18, 2011 at 15:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .