On my Windows 2008 web server I've also setup an FTP site with user isolation within user folders and the NTFS permissions are set so that users only have read access to their own folder.

Though I am by no means a security expert I am attempting to be security conscious so I would like to know if there are any other steps I can take to harden the FTP service against attack? I've read that FTP is not very secure so I want to do everything I can to combat that.

The data available to the users on the FTP site is not sensitive so encryption is not a requirement. Mainly I just want to make every effort to keep malicious users out of any other parts of the web server.

  • SSH might be a better alternative regarding security. Users should have no trouble using WinSCP or similar applications to access files. – DrMoishe Pippik Aug 10 '15 at 20:35
  • Thank you DrMoishe Pippik, I will look into that alternative. – Ben Bloodworth Aug 10 '15 at 21:43
  • Should be reasonably secure if there aren't any NTFS junction points present and the users can't create them some other way. Junction points would provide a way for the users to traverse higher up the directory tree if they pointed outside of the isolation environment. – ssnobody Aug 10 '15 at 22:01
  • Thanks ssnobody. I was not familiar with NTFS junction points but after looking them up it appears that I would have needed to intentionally create them, which I have not. As far as users creating junction points, I believe they should not be able to create anything since I've only given them read permissions. – Ben Bloodworth Aug 11 '15 at 13:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.