FTP Service Properties

You use the Service property sheet to control who can use your server and specify the account used for anonymous client requests to log on to the computer. Most Internet sites allow anonymous logons. If you allow anonymous logons, then all user permissions for the user, such as permission to access information, will use the IUSR_computername account. To use your current security system to control information access, change the anonymous logon account from IUSR_computername  to an existing account on your network.

This property sheet also sets the comment in the Internet Service Manager report view.

Connection Timeout

Sets the length of time in seconds before the server disconnects an inactive user. It is recommended that you not set this number lower than 100 seconds. The maximum you can set is 32,767 seconds. This value ensures that all connections are closed if the FTP protocol fails to close a connection.

Maximum Connections

Sets the maximum number of simultaneous connections to the server.

Allow Anonymous Connections

Sets the Windows NT user account to use for permissions of all anonymous connections. By default, Internet Information Server creates and uses the account IUSR_computername for all anonymous logons. Note that the password is used only within Windows NT; anonymous users do not log on using this username and password.

Typically, anonymous FTP users will use "anonymous" as the username and their e-mail address as the password. The FTP service then uses the IUSR_computername account as the logon account for permissions.

Allow only anonymous connections

Select this box to all only anonymous connections. With this box selected, users cannot logon with user names and passwords. This prevents access by using an account with administrative permission; only the account specifed for anonymous access is granted access.

Comment

Specifies the comment displayed in Internet Service Manager's Report view.

Current Sessions

Click to display the current FTP users.


FTP User Sessions

Displays the currently connected FTP users.

Connected Users

Lists the currently connected users by IP address and when they connected.

Refresh Button

Press to update the display of connected users.

Disconnect Buttons

Press to disconnect the selected user, selected users, or all users.


FTP Messages

Displays messages sent to clients. You can edit these messages as you like.

Welcome message

Displays this text to clients when they first connect to the FTP server.

Exit message

Displays this text to clients when they log off the FTP server.

Maximum connections message

Displays this text to clients that try to connect when the FTP service already has the maximum number of client connections allowed.


FTP Directories

The FTP Directories property sheet sets directories and directory behavior for the FTP service.

Directory listing box

Lists the directories used by the FTP service.

Directory lists the path of directories used by the FTP service.

Alias is the path for service users for virtual directories.

Error indicates system errors, such as difficulty reading a directory.

Add, Remove, and Edit buttons

To set up a directory, press the Add button or pick a directory in the Directories listing box and press the Edit button. The Remove button removes the directories you select.

Directory Listing Style

Choose the directory listing style to send to FTP users, whether you want files listed in UNIX or MS-DOS format. Because many browsers expect UNIX format, you should select UNIX for maximum compatiblity.


FTP Directory Properties

Configure the FTP service directories by using this dialog box.

Directory

Sets the path to the directory to use for the FTP service.

Browse button

Use to select the directory to use for the FTP service.

Home Directory

Choose this to specify the root directory for the FTP service.

Internet Information Server provides a default home directory, \Ftproot, for the FTP service. The files that you place in the FTP home directory, and its subdirectories, are available to remote browsers. You can change the location of the default home directory.

Virtual Directory

Choose this to specify a subdirectory for the FTP service. Enter the directory name or "alias" that service users will use.

You can add other directories outside the home directory that are accessible to browsers as subdirectories of the home directory. That is, you can publish from other directories and have those directories accessible from within the home directory. Such directories are called “virtual directories.”

Note that virtual directories will not appear in FTP directory listings; FTP users must know the virtual directory's alias, and type in its URL address in the FTP application or browser.

The administrator can specify the physical location of the virtual directory and the virtual name (alias), which is the directory name used by remote browsers.

The published directories can be located on local or network drives. If the virtual directory is a network drive, provide the username and password with access to that network drive. Virtual directories on network drives must be on computers in the same Windows NT domain as the Internet Information Server.

Account Information

This box is active only if the directory specifed in the first line of this dialog box is a Universal Naming Convention (UNC) server and share name, for example, \\webserver\htmlfiles. Enter the username and password that has permission to use the network directory. Virtual directories on network drives must be on computers in the same Windows NT domain as the Internet Information Server.

Important  If you specify a username and password to connect to a network drive, all Internet Information Server access to that directory will use that username and password. You should use care when using UNC connections to network drives to prevent possible security breaches.

Access check boxes

The Access check boxes control the attributes of the directory. If the files are on an NTFS drive, NTFS settings for the directory must match these settings.

Read must be selected for FTP directories.

Write allows clients to write files to the FTP server. Select this only for directories that are intended to accept files from users.


FTP Logging Properties

The Logging property sheet sets logging  for the selected information service.

Logging provides valuable information about how a server is used. You can send log data to files or to an Open Data Base Connectivity (ODBC)–supported database. If you have multiple servers or services on a network, you can log all their activity to a single file or database on any network computer.

If you want to log to a file, you can specify how often to create new logs and which directory put the log files in. The Convlog.exe command prompt command converts log files to either European Microsoft Windows NT Academic Centre (EMWAC) log files or the common log file format.

If you log to an ODBC data source, you must specify the ODBC Data Source Name (DSN), table, and valid user name and password to the database.

Enable Logging

Select this box to start or stop logging for the selected information service.

Log to File

Choose this option to log to a text file for the selected information service.

Automatically open new log

Select this box to generate new logs at the specifed interval. If not selected, the same log file will grow indefinitely.

Log file directory

Shows the path to the directory containing all log files. To change directories, click Browse and select a different directory.

Log file filename

Names the log file. The lowercase letters yy will be replaced with the year, mm will be replaced with the month, and dd will be replaced with the day.

Log to SQL/ODBC Database

Choose to log to any ODBC data source. Set the Datasource name, Table name (not the filename of the table), and specify a user name and password that is valid for the computer on which the database resides. You must also use the ODBC applet in Control Panel to create a system data source.


FTP Advanced Properties

The Advanced property sheet sets access by specific IP address to block individuals or groups from gaining access to your server. You can also set the maximum network bandwidth for outbound traffic, to control the maximum amount of traffic allowed on your server.

IP Access Control

You can control access to each Microsoft Internet Information Server service by specifying the IP address of the computers to be granted or denied access.

If you choose to grant access to all users by default, you can then specify the computers to be denied access. For example, if you have a form on your WWW server and a particular user on the Internet is entering multiple forms with ficticious information, you can prevent the computer at that IP address from connecting to your site. Conversely, if you choose to deny access to all users by default, you can then specify which computers are allowed access.

Granted Access

Choose this option, then click the Add button to list computers that will be denied access.

Denied Access

Choose this option, then click the Add button  to list computers that will be granted access.

Add

To add computers that you want to deny access to, select the Granted Access button and click Add. Conversely, to add computers that you want to grant access to, select the Denied Access button, and click Add.

Limit Network Use by all Internet Services on this computer

You can control your Internet services by limiting the network bandwidth allowed for all of the Internet services on the server. Set the maximum kilobytes of outbound traffic permitted on this computer.


FTP Grant or Deny Access

Choose Single Computer and provide the IP Address to exclude a single computer. Choose Group of Computers and provide an IP Address and subnet mask to exclude a group of computers. Press the button next to the IP address to use a domain name system (DNS) name instead of IP address. Your server must have a DNS server specified in its TCP/IP settings.

You are specifying, by IP address or domain name, which computer or group of computers will be granted or denied access. If you choose to, by default, grant access to all users, you will specify the computers to be denied access. If you choose to, by default, deny access to all users, you will then specify the specific computers to be allowed access. You should fully understand TCP/IP networking, IP addressing, and the use of subnet masks to use this option.


Basic (clear text authentication)
Internet Service Manager Authentication Options

In addition to the "anonymous logon" username and password fields, the Service property sheet of Internet Service Manager contains the following authentication options:

Allow Anonymous Connections   When this check box is selected, FTP logons in which the user enters a username of "anonymous" will be processed. These anonymous connections will be processed on behalf of the Windows NT user account specified on the Service property sheet. When this check box is cleared, users will be required to enter valid Windows NT usernames and passwords to log onto the FTP service.

Allow only anonymous connections   When this checkbox is selected, user logons with a username other than "anonymous" will be rejected.

Warning: FTP usernames and passwords are sent across the network in clear text. When this check box is cleared, Windows NT passwords will be sent to the server without encryption. This check box is checked by default for security reasons.


Help not available.


Help not available.


Controlling Security by UserName and Password

To set username and password security

1	In Internet Service Manager, double-click the FTP service and then click the Service tab to display that property sheet.

2	In the Allow Anonymous Connections box, type the username and password that you want the FTP service to use when accessing resources on behalf of a client.

This account must be a valid account set up in the Windows NT User Manager. Permissions assigned to this account apply to all anonymous logons.

3	Select the Allow only anonymous connections feature if you want to deny access to any non-anonymous logons.

This option is handy if you do not want users to log in with their own usernames and passwords because FTP passwords are unencrypted. However, all users will have the same access privilege, as defined by the anonymous account. By default, this option is not enabled. Select this option if users should not connect by using their Windows NT user accounts.

4	Click OK.


Setting Directory Listing Style

To determine how directory listings are displayed

1	In Internet Service Manager, click the Directories tab.

2	In the Directory Listing Style box, select:

UNIX to display directories in UNIX format.

MS-DOS to display directories in MS-DOS format.


Viewing Current Sessions

1	In Internet Service Manager, double-click the FTP service.

2	Click the Service tab.

3	Click Current Sessions.

4	If you want to disconnect a user, select the user and then click Disconnect. To disconnect all connections, click Disconnect All.

5	Click Close and then click OK.


Directory Annotation Files

You can add directory descriptions to inform FTP users of the contents of directories on the server.

To annotate files

1	Create a file called ~ftpsvc~.ckm in the directory where you want to annotate with the information to be displayed to the user.

2	In the Windows NT File Manager, select the file and make it a hidden file so that directory listings do not display this file.

3	Use Regedt32.exe to enable annotated directories by adding the following value. HKEY_LOCAL_MACHINE
  \SYSTEM
    \CurrentControlSet
      \Services
        \MSFTPSVC
          \Parameters

AnnotateDirectories     REG_DWORD

Range: 0 or 1

Default = 0 (false -- that is, directory annotation is off).

The preceding value defines the default behavior of directory annotation for newly connected users. Directory descriptions are used to inform FTP users of the contents of a directory on the server. The directory description is saved in a file named ~ftpsvc~.ckm, which is usually a hidden file. When this value is 1, directory annotation is enabled.

This Registry entry does not appear by default in the Registry, so you must add an entry if you want to change its default value.


Customizing Messages

To customize Welcome, Exit, and Maximum connections messages

1	In Internet Service Manager, double-click the FTP service.

2	Click the Messages tab.

3	In the Welcome message box, type the welcome message you want to display when users connect.

4	In the Exit message box, type the message you want to display when users disconnect.

5	In the Maximum connections message box, type the message you want to display when a user tries to connect but cannot because the maximum number of users are already connected.

6	Click Apply and then click OK.


What is the FTP Service?

FTP was one of the earliest protocols used on TCP/IP networks and the Internet. FTP is used to transfer files from one computer on a network to another computer on the same network. FTP was especially useful for transferring files between different computers, such as transferring files from a UNIX computer to a computer running MS-DOS or Windows 3.1.

Early FTP client software was character based, and was similar to using the Windows NT command prompt to list and copy files. A character-based program was used to log on to the remote computer, browse directories, and to then transfer files.

Internet Explorer simplifies this process by automatically logging you onto the FTP server if anonymous connections are permitted. Directory listings are automatically displayed as hypertext links, permitting point-and-click simplicity in navigating directories and copying files from a server to a client. (Note that you cannot copy files from a client to a server by using Internet Explorer.)


When Should I Use the FTP Service?

The World Wide Web (WWW) has replaced most functions of FTP. However, only FTP can be used to copy files from a client computer to a server. If your remote users need to do this, they must use FTP.

Also, if you have existing files that you want to make available to remote users, FTP is an extremely easy server to install and maintain. After installation, point the FTP service to your files; no additional configuration is necessary.

Files made available through FTP can be in any format, such as document files, multimedia files, or application files. If your remote clients are using Internet Explorer, the clients can specify whether to copy the file or to start a helper application to immediately display or play the file.


How Does the FTP Service Work?

The FTP service requires that users log on to use the service. Once logged on, users can navigate the directories made available to the FTP service. And on older, dedicated FTP clients, remote users can copy files to the server and issue other FTP commands, including logging off.

Configuring Session Activity

You can configure the number of simultaneous connections allowed, and the amount of time allowed for connections.

Because users are logged on until they log off or break the connection, you can use the Connected Users button in the Service property sheet to keep track of which users are currently connected.

Configuring FTP Logon

You use Internet Service Manager to configure logon requirements for the FTP service.

If the FTP service is configured for anonymous logon, clients can log on with the user name “anonymous.” Traditionally, anonymous FTP users log on using their e-mail addresses as passwords. Note that Internet Explorer automatically logs on anonymously to all FTP servers that permit anonymous logon.

FTP clients are also permitted, by default, to log on with a Windows NT username and password permitted to use that computer. This allows you to control every user’s access permissions and file access on Windows NT File System (NTFS) drives.

Select the Allow anonymous only check box to prevent users from using usernames. With this check box enabled, any account other than “anonymous” cannot log on. This is useful for security because only one account, that assigned for anonymous logon, is permitted access; intruders cannot attempt to gain access with the administrator account.


Configuring FTP Directories

By default, all subdirectories are available in the home directory. You should place all your FTP files in the home directory.

You can also add virtual directories, just as with the WWW service; however, because of FTP’s technical limitations as an older protocol, virtual directories are not visible to users. Users can enter a virtual directory only if they know the alias of the virtual directory.

Setting Listing Style

Some browsers require that the FTP listing be styled in UNIX format. You should set the FTP listing style to UNIX format for maximum compatibility with browsers.

Setting Read and Write Permission

You must set Read and Write permission by using Internet Service Manager. On NTFS drives you must also set matching permissions by using File Manager.

Read

In order for an FTP client to be allowed to see a directory in a directory listing and Get (download) files from that directory, the Read permission must be set for that directory.

Read permissions is set to all directories by default. Remove Read permission and set Write permission to create a dedicated directory to which users can copy files, but cannot see any files left by others.

Write

In order for an FTP client to be able to Put (upload) files into a directory, the Write permission must be set for that directory. If a directory has the Write permission enabled and the Read permission disabled, the directory will not appear in directory listings--but an FTP client can change to the directory, assuming the user knows the name of the directory. Files can then be uploaded into the directory.

Setting Write permission will allow users to place files on your server.

Creating Annotation Files

Each directory can contain an annotation file, which can be used to summarize the information that the directory contains. This summary appears automatically to remote browsers.

You can add directory descriptions to show FTP users the contents of a particular directory on the server. This is done by creating a file called ~ftpsvc~.ckm in that directory. Usually you want to make this a hidden file so that directory listings do not display it. You must also add a Registry value. See Directory Annotation Files for more information.

Special Directories in the Home Directory

You can add special directories to the home directories to control the root directory displayed to FTP users. These directories must be physical subdirectories; they cannot be specified by using virtual directories.

Using Username Directories

Username directories are directories in the home directory with names that match a username. If a user logs on with a username that has a matching directory in the home directory, that directory is used as the root.

You can use FTP username directories to control the root directory presented to users. FTP username directories are not created by default during setup.

Using the Anonymous Directory

The Anonymous directory is a directory in the home directory named “Anonymous”. If a user logs on using the password Anonymous, the directory name Anonymous is used as the root.

You can use FTP username directories to control the root directory presented to users. FTP username directories are not created by default during setup.


FTP Clients

You can use any FTP client to connect to the Internet Information Server FTP service. Windows NT Workstation and Windows NT Server include a character-based FTP client. This client is started at the command prompt by typing ftp.

Microsoft Internet Information Server also includes Internet Explorer, which you can use to browse FTP servers. You use a Uniform Resource Locator (URL) to connect to an FTP server; for example, ftp://ftp.microsoft.com/.