FTP server override NTFS permissions

[jonathonoss]

I have a situation where I set the IUSR_MACHINENAME account to have read-only NTFS permissions for a directory (also explicity denying write), meanwhile in the FTP snapin, IUSR_MACHINENAME is the account for anonymous logins, and there is write and read access set for all logins.

My problem is that the anonymous account can do whatever it wants, although I have specified NTFS permissions to be more restrictive. I even explicitly deny all NTFS permissions to the anonymous user, yet the anonymous user can still do anything it wants.

Yes, I have checked a hundred times that the virtual root is pointing to the right directory, and again, the IUSR-MACHINENAME account in the NTFS permissions matches the anonymous user in the FTP Snapin.

I have set the same scenario up on other W2K SP2 machines (server and workstation), and I can successfully deny write access to the anonymous user (while allowing write access to whomever I specify in the NTFS permissions). But why won't it work on the important FTP server? I have restarted the FTP server, reinstalled the FTP server, restarted the machine, but nothing works. I really don't want to (and shouldn't have to) reinstall W2K.

I have spent way too much time on this seemingly simple problem. I am baffled as to why this won't work on the machine I need it to work! Any ideas?

Thanks,

Jon

 

[williamsl]

Jon,
Have you checked the FTP virtual directory permissions? When you created the virtual directory, you should have chosen to give read permissions only to the virtual directory. Be sure that write is not checked. I found that when creating a virtual directory, the permissions you give to the virtual directory override the NTFS permissions you put on the actual folder where the data is stored.

Hope this is the answer you are looking for.

 

[jonathonoss]

Thanks for your reply.

I just checked the FTP server to test the permissions again, and now it works. No one has touched it since I wrote the initial message. I don't know why it didn't work then but works now. Right before I wrote the message, I logged in as the anonymous user to test the NTFS permissions and that is it. I have not changed permissions or anything.

In response to your reply, if I am not mistaken, the permissions granted will be the most restrictive of the NTFS permissions and the permissions (read or write) for the FTP site.

I should be able to check 'write' permissions in the FTP snapin, and then for the NTFS permissions select 'read' and 'write' for user 'A', and 'read' for user 'B'. The result for user 'B' should be 'read' only as it is the most restrictive permission between the NTFS and FTP snapin permissions. User 'A', on the other hand, would be able to 'read' and 'write'.

Jon