FTP user isolation, Isolate users using Active Directory
Web Server forum
Back To The Forum Home!Search!Private Messaging System

Web Server Talk Web Server Talk > Web Servers reviews > IIS server support > IIS FTP Server > FTP user isolation, Isolate users using Active Directory




  Last Thread   Next Thread Next
  Show Printable Version Email this Page Subscribe to this Thread      Post New Thread    Post A Reply      

    FTP user isolation, Isolate users using Active Directory  
ajndede


View Ip Address Report This Message To A Moderator Edit/Delete Message


 
08-07-05 10:53 PM

Have created a FTP site on a Windows 2003 SBS server using the “Isolate us
ers
using Active Directory” option. My problem is that I get a error when I lo
gin
“530 User XXXXX cannot login, home directory inaccessible”.

Here is what I have done.
Added login locally rights to the users and groups that need access by
setting it in the default domain policy.

Added permissions to directories created to include users that needed access

Set the msIIS-FTPRoot and msIIS-FTPDir with the VBS metod outlined in a
Microsoft article

iisftp.vbs /SetADProp (User name) FTPRoot \\Inetpub\ftproot
iisftp.vbs /SetADProp (User name) FTPDir \(User name)

Verified that the msIIS-FTPRoot and msIIS-FTPDir were set correctly by using

iisftp /GetADProp (User Name) FTPRoot
iisftp /GetADProp (User Name)

Path from MetaBase.xml
<IIsFtpVirtualDir Location="/LM/MSFTPSVC/1/ROOT" AccessFlags="AccessRead"
Path="c:\inetpub\ftproot" />

My directory structure (have substituted localuser with mydomain and
mydomain.local, nothing works)

c:\
|
|---Windows
|
|---Inetpub
|       |
|       |---wwwroot
|       |
|       |---ftproot
|       |       |
|       |       |---localuser
|       |       |      |
|       |       |      |---test1
|       |       |      |
|       |       |      |---test2

Output from CuteFTP

STATUS:>	Socket connected. Waiting for welcome message...
220 Microsoft FTP Service
STATUS:>	Connected. Authenticating...
COMMAND:>	USER xxxxxx
331 Password required for xxxxxx.
COMMAND:>	PASS ********
530 User xxxxxx cannot log in, home directory inaccessible.
ERROR:>	Password not accepted
ERROR:>	Can't login. Still trying...


I have been reading articles and trying to get this to work for almost 2
weeks, does anyone have any ideas, suggestions, or know of something I am
missing.

Thanks
AJ






[ Post a follow-up to this message ]



    Re: FTP user isolation, Isolate users using Active Directory  
Chris Crowe [MVP]


View Ip Address Report This Message To A Moderator Edit/Delete Message


 
08-08-05 07:51 AM

Hi

One thing to check with what you have shown below is your SetADProp FTPRoot
command

Your message displayed \\Inetpub\ftproot as the FTPRoot which to me means a
machine on the network called "Inetpub" with a file share called "ftproot" -
so this could be your problem if you were refeering to c:\inetpub\ftproot

If the FTP Directory is on the local SBS server then use this syntax

Our "Virtual Home Directory" for user folders is c:\inetpub\ftproot
Our Username is "Chris"

so out path for useraccount "Chris" is "c:\inetpub\ftproot\chris"

So the commands would be:

IIsFtp /SetADProp Chris FTPRoot c:\inetpub\ftproot
IIsFtp /SetADProp Chris FTPDir Chris

Doing this works fine for me on SBS2003.

Please let me know if this was any help to you.

--

Cheers

Chris

Chris Crowe [IIS MVP]
http://blog.crowe.co.nz

"ajndede" <ajndede@discussions.microsoft.com> wrote in message
news:03A5E87C-8740-4983-B1FF-6D2E7A2EC165@microsoft.com...
> Have created a FTP site on a Windows 2003 SBS server using the "Isolate
> users
> using Active Directory" option. My problem is that I get a error when I
> login
> "530 User XXXXX cannot login, home directory inaccessible".
>
> Here is what I have done.
> Added login locally rights to the users and groups that need access by
> setting it in the default domain policy.
>
> Added permissions to directories created to include users that needed
> access
>
> Set the msIIS-FTPRoot and msIIS-FTPDir with the VBS metod outlined in a
> Microsoft article
>
> iisftp.vbs /SetADProp (User name) FTPRoot \\Inetpub\ftproot
> iisftp.vbs /SetADProp (User name) FTPDir \(User name)
>
> Verified that the msIIS-FTPRoot and msIIS-FTPDir were set correctly by
> using
>
> iisftp /GetADProp (User Name) FTPRoot
> iisftp /GetADProp (User Name)
>
> Path from MetaBase.xml
> <IIsFtpVirtualDir Location="/LM/MSFTPSVC/1/ROOT" AccessFlags="AccessRead"
> Path="c:\inetpub\ftproot" />
>
> My directory structure (have substituted localuser with mydomain and
> mydomain.local, nothing works)
>
> c:\
> |
> |---Windows
> |
> |---Inetpub
> |       |
> |       |---wwwroot
> |       |
> |       |---ftproot
> |       |       |
> |       |       |---localuser
> |       |       |      |
> |       |       |      |---test1
> |       |       |      |
> |       |       |      |---test2
>
> Output from CuteFTP
>
> STATUS:> Socket connected. Waiting for welcome message...
> 220 Microsoft FTP Service
> STATUS:> Connected. Authenticating...
> COMMAND:> USER xxxxxx
> 331 Password required for xxxxxx.
> COMMAND:> PASS ********
> 530 User xxxxxx cannot log in, home directory inaccessible.
> ERROR:> Password not accepted
> ERROR:> Can't login. Still trying...
>
>
> I have been reading articles and trying to get this to work for almost 2
> weeks, does anyone have any ideas, suggestions, or know of something I am
> missing.
>
> Thanks
> AJ
>







[ Post a follow-up to this message ]



    Re: FTP user isolation, Isolate users using Active Directory  
Bernard Cheah [MVP]


View Ip Address Report This Message To A Moderator Edit/Delete Message


 
08-10-05 12:57 PM

Yupe thats look like the issue. Also you can get filemon (sysinternals.com)
and trace which folder IIS Ftp is trying to redirect the user.

--
Regards,
Bernard Cheah
http://www.microsoft.com/iis/
http://www.iiswebcastseries.com/
http://www.msmvps.com/bernard/


"Chris Crowe [MVP]" <IISMVP2005@iisfaq.homeip.net> wrote in message
news:%23aIAiP9mFHA.3608@TK2MSFTNGP15.phx.gbl...
> Hi
>
> One thing to check with what you have shown below is your SetADProp
> FTPRoot command
>
> Your message displayed \\Inetpub\ftproot as the FTPRoot which to me means
> a machine on the network called "Inetpub" with a file share called
> "ftproot" - so this could be your problem if you were refeering to
> c:\inetpub\ftproot
>
> If the FTP Directory is on the local SBS server then use this syntax
>
> Our "Virtual Home Directory" for user folders is c:\inetpub\ftproot
> Our Username is "Chris"
>
> so out path for useraccount "Chris" is "c:\inetpub\ftproot\chris"
>
> So the commands would be:
>
> IIsFtp /SetADProp Chris FTPRoot c:\inetpub\ftproot
> IIsFtp /SetADProp Chris FTPDir Chris
>
> Doing this works fine for me on SBS2003.
>
> Please let me know if this was any help to you.
>
> --
>
> Cheers
>
> Chris
>
> Chris Crowe [IIS MVP]
> http://blog.crowe.co.nz
>
> "ajndede" <ajndede@discussions.microsoft.com> wrote in message
> news:03A5E87C-8740-4983-B1FF-6D2E7A2EC165@microsoft.com... 
>
>







[ Post a follow-up to this message ]



    Re: FTP user isolation, Isolate users using Active Directory  
ajndede


View Ip Address Report This Message To A Moderator Edit/Delete Message


 
08-10-05 10:54 PM

That seemed to have worked Chris, Thanks for the help

AJ

"Chris Crowe [MVP]" wrote:

> Hi
>
> One thing to check with what you have shown below is your SetADProp FTPRoo
t
> command
>
> Your message displayed \\Inetpub\ftproot as the FTPRoot which to me means 
a
> machine on the network called "Inetpub" with a file share called "ftproot"
 -
> so this could be your problem if you were refeering to c:\inetpub\ftproot
>
> If the FTP Directory is on the local SBS server then use this syntax
>
> Our "Virtual Home Directory" for user folders is c:\inetpub\ftproot
> Our Username is "Chris"
>
> so out path for useraccount "Chris" is "c:\inetpub\ftproot\chris"
>
> So the commands would be:
>
> IIsFtp /SetADProp Chris FTPRoot c:\inetpub\ftproot
> IIsFtp /SetADProp Chris FTPDir Chris
>
> Doing this works fine for me on SBS2003.
>
> Please let me know if this was any help to you.
>
> --
>
> Cheers
>
> Chris
>
> Chris Crowe [IIS MVP]
> http://blog.crowe.co.nz
>
> "ajndede" <ajndede@discussions.microsoft.com> wrote in message
> news:03A5E87C-8740-4983-B1FF-6D2E7A2EC165@microsoft.com... 
>
>
>





[ Post a follow-up to this message ]



    Sponsored Links  




 





   All times are GMT. The time now is 02:19 AM.      Post New Thread    Post A Reply      
  Last Thread   Next Thread Next


Most Popular forums 

Forum Jump:
Rate This Thread:

Forum Rules:
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
HTML code is OFF
vB code is ON
Smilies are ON
[IMG] code is OFF
 
Medical and Health forum | Computer Games Reviews | Graphics design forum

Back To The Top
Home | Usercp | Faq | Register