Configuring the FTP Service

Configuring the FTP Service

In addition to providing Web server functionality to Windows 2000, IIS provides an FTP service. This service, if implemented, must be secured to ensure that the server hosting the FTP service is not compromised.

FTP allows users to transfer files to and from an FTP server. If you must implement FTP on your network, consider the following security guidelines:

• Implement only anonymous access.

  Like most Internet-based protocols, the FTP protocol does not provide any security mechanisms for user credentials. User credentials are passed in cleartext and can lead to the compromise of a user s domain credentials. You can configure the FTP service to allow only anonymous connections to prevent credential interception.

  Configuring FTP to allow only anonymous connections does not prevent a user from inputting his user name and password in an FTP session. It only prevents those credentials from being accepted by the FTP server.

• Prevent Write access to the FTP server.

  Disabling Write access prevents users from uploading information to the FTP server. If you require the ability to upload files to the FTP server, consider creating a separate folder in the FTP site that allows only uploads. This is configured by assigning only Write permissions to the folder.

• Implement a custom anonymous user account.

  The account defined for the Web service can be implemented as the anonymous user account for the FTP service. NTFS permissions can be assigned to a custom local group at the FTP server that contains only the custom anonymous user account.

• Implement the FTP home folder on a different volume than the OS.

  As with the Web service, it is recommended you create a folder structure for the FTP service that resides on a different volume than the OS. This involves changing the default folder from the default of %systemdrive%\Inetpub\Ftproot.

• Enable logging.

  Enable logging of the FTP service so that all connections to the FTP server are recorded to FTP audit logs. This allows you to review all connections to the FTP server.