I've added a FTP site to IIS 8.5 on my Windows Server 2012 R2 Datacenter VM on Azure and added a "ftpuser" Windows user that I want to use for ftp access. Everything works fine if I Remote Desktop to the server and run ftp localhost at a command prompt, but if I try to access the FTP server remotely (or even locally, but using the external IP address), I can connect fine, but the login process always fails with 530 Authentication failed..

I have logging enabled for the FTP server, but nothing is logged for these failed attempts.

I've checked that the user has "Allow log on locally" and "Access this computer from the network" permissions (the Users group is there for both).

The Windows firewall and the Azure VM Endpoints are set up to pass TCP ports 21, and the configured range of passive TCP ports (60100-60104). The external IP of the VM is set as the "External IP Address of Firewall" in the FTP Firewall Support in IIS Manager.

Here's what the logging looks like in Filezilla:

Status: Connecting to x.x.x.x:21...
Status: Connection established, waiting for welcome message...
Status: Insecure server, it does not support FTP over TLS.
Command:    USER ftpuser
Response:   331 User name okay, need password for ftpuser.
Command:    PASS *********
Response:   530 Authentication failed.
Error:  Critical error: Could not connect to server

I've captured the FTP packets on both the client and the server using Wireshark and they show that the username and password are being received by the server, but that it's rejecting the request with a 530 when it's received from a client that didn't connect to localhost.

Any idea what's causing these remote logins to fail?

  • docs.microsoft.com/en-us/iis/publish/using-the-ftp-service/… It might get you started. – Lex Li Jun 10 '18 at 18:02
  • @LexLi Thanks, I followed something similar to get this far. I don't see anything I missed though. – JohnnyHK Jun 10 '18 at 18:16
  • The article emphasizes a lot of firewall related settings to allow packets to pass through. When you host the server on Azure, there is a second firewall in Azure to filter out packets. Thus, try to apply the same to Azure settings and you might figure it out. – Lex Li Jun 10 '18 at 19:36
  • Yep, I've got the firewall and the Azure VM endpoints set to pass the configured ports for FTP. – JohnnyHK Jun 10 '18 at 19:48
  • Then all your hope is to capture FTP packets on both the client and the server to see further into the issue. Packets won't lie. Good luck. – Lex Li Jun 10 '18 at 19:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.