-2

I have setup a secured FTP (SFTP) using OpenSSH and my IIS. It works fine, I am able to loginto the root folder of my FTP. I am now trying to setup folders per user (one user can only one folder)and I have followed several tutorials for FTP User Isolation (http://woshub.com/ftp-site-with-user-isolation-on-windows-server-2012-r2/, https://blogs.iis.net/robert_mcmurray/FTP-User-Isolation-with-Multiple-User-Accounts), create the folders as requested (LocalUser and folders named after the user accounts), setup folder permissions accordingly, created virtual directories, isolate users.. When I try to log into WinSCP or FileZilla, each indivudal user can still access the whole folder structure.

What did I miss? Could it related to the fact that I am using SFTP instead of a regular FTP or FTPS?

Thank you

Improve this question
1
  • It might help if you provided a lot more information showing screens for how you configured both the client and the server. You can delete or use mspaint to cover up any parts you don't want to show. And since IIS is involved here you could add a tag for IIS. (and any troubleshooting you might have done).
    – barlop
    Sep 16, 2022 at 13:55

1 Answer 1

Reset to default
-1

SFTP is not really "SSH FTP" – it's a completely different protocol with no relationship to the FTP[S] protocols except the name. Your IIS doesn't host SFTP and OpenSSH doesn't host FTP[S].

(Though e.g. ProFTPd can host both protocols, and WinSCP/FileZilla can connect to both.)

As SFTP is usually meant to complement SSH, any file you can access through SSH is also accessible through SFTP as well. Depending on which SFTP server implementation you are using, it may be possible to change this for "SFTP-only" accounts – but in OpenSSH this is only doable through the "ChrootDirectory" option, which does not work on Windows (it relies on the OS providing the chroot function).

Improve this answer
6
  • THank you, it is clearer. Since I used OpenSSH and that jailed user aare only doable using ChrootDirectory which is not available on Windows, it means that I can not create isolated users in SFTP on Windows, right? If I want isolated users on Windows Server, does it mean that I have to use FTPS only?
    – Sylvain C.
    Sep 16, 2022 at 14:08
  • 1
    You can, but you'll need a different SFTP server than OpenSSH. For example, Bitvise WinSSHd is a good SSH server in general and seems to support customizable "mount points" for SFTP clients. (And looks like recent versions of WinSSHd can additionally serve FTPS, too.)
    – user1686
    Sep 16, 2022 at 14:15
  • THank you very much , I will look at bitvise. Form the woshub link above, it also seems that we can set an individual chrootdirectory for each user in Windows. I will also check that.
    – Sylvain C.
    Sep 16, 2022 at 17:02
  • Ah, right, Microsoft says they added partial (SFTP-only) support to Windows-OpenSSH 7.7 as well, though I'd still prefer Bitvise's if the license allows.
    – user1686
    Sep 16, 2022 at 17:57
  • Thank you again. I just tried the personal edition of BitVise and it fits my needs. Perfect.
    – Sylvain C.
    Sep 16, 2022 at 20:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.