0

I'm using Windows 2012 server with IIS FTP component. I'm created a new local user in the server that clients, who using FTP protocol, can access with.

The client is "Writer only". I'm want to give him enough permission to write his knowledge, but never allow him to read written files.

The needed permission are:

  1. Delete \ Create file.
  2. Delete \ Create directory.
  3. Listing directory: files and sub-directories.
  4. Override file content.

Which windows-permissions I'm need to give my "Writer" user?

Thank you!

2 Answers 2

0

The user should be given "modify" permission. This will allow them to add, edit and delete files and folders inside the folder to which they have permission, but not be able to delete or modify the permissions of that parent folder.

2
  • With "modify" permission, attacker can read the content of the file? If the answer is Yes, so, I'm prefer to limit my user for delete and creation of files. In this way I'm can be sure that this user cannot read content of files? May 29, 2014 at 8:23
  • If you only grant modify permission to that user then, no, an attacker can't just start changing content - unless they log in as the user who has permission...
    – Kinnectus
    May 29, 2014 at 9:00
0

You want to avoid Modify perms since it will allow the reading of their own written data ( a privilege your requirements want to avoid ) This requires granular NTFS perms beside the IIS FTP perms and the granular perms are eponymous in the NTFS checkbox you should hopefully already be familiar with.

It is important you remove the "Creator/Owner" user from the isolated directory devoted to this constrained user and specifically grant just your List and write but not the Read permissions.

You may be tempted to specifically Deny certain privileges which always evokes emotional warnings but can be valuable in your case as long as you can adequately test and monitor the users successful interactions / uploads to your FTP instance.

1
  • My bad, didn't read the question fully!
    – Kinnectus
    May 29, 2014 at 9:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .