Recently I was working on a case where we wanted to setup FTP User level isolation .
We created test FTP site with basic authentication enabled and created the folder structure required for User isolation with “username directory(disable global virtual directory)
|
Windows domain accounts (requires basic authentication) |
%FtpRoot%%UserDomain%%UserName% |
- User name directory (disable global virtual directories) : This option specifies that you want to isolate FTP user sessions to the physical or virtual directory with the same name of the FTP user account. The user sees only their FTP root location and is, therefore, restricted from navigating higher up the physical or virtual directory tree
- To create home directories for each user, you first need to create a physical directory under your FTP server's root folder that is named after your domain or named LocalUser for local user accounts. Next, you need to create a physical directory for each user account that will access your FTP site. The following table lists the home directory syntax for the authentication providers that ship with the FTP service.
|
User Account Types |
Physical Home Directory Syntax |
|
Anonymous users |
%FtpRoot%\LocalUser\Public |
|
Local Windows user accounts (requires basic authentication) |
%FtpRoot%\LocalUser%UserName% |
|
Windows domain accounts (requires basic authentication) |
%FtpRoot%%UserDomain%%UserName% |
|
IIS Manager or ASP.NET custom authentication user accounts |
%FtpRoot%\LocalUser%UserName% |
We started seeing issues where user isolation was not working and failing with “access denied” error. We checked and found NTFS and FTP default permissions to be ok and good.
We collected procmon and found that there was No access denied errors but failing with "PATH NOT FOUND"
3:02:25.5810043 PM svchost.exe 6128 TCP Accept ITL-DC-SFTP-2.Contoso.lab.lan:2121 -> 172.21.12.104:50495 SUCCESS Length: 0, mss: 1380, sackopt: 1, tsopt: 0, wsopt: 1, rcvwin: 262200, rcvwinscale: 8, sndwinscale: 8, seqnum: 0, connid: 0 NT AUTHORITY\SYSTEM
3:02:25.5934536 PM svchost.exe 6128 TCP Send ITL-DC-SFTP-2.Contoso.lab.lan:2121 -> 172.21.12.104:50495 SUCCESS Length: 27, startime: 9113403, endtime: 9113405, seqnum: 0, connid: 0 NT AUTHORITY\SYSTEM
3:02:25.5934751 PM svchost.exe 6128 TCP Receive ITL-DC-SFTP-2.Contoso.lab.lan:2121 -> 172.21.12.104:50495 SUCCESS Length: 35, seqnum: 0, connid: 0 NT AUTHORITY\SYSTEM
3:02:25.5987981 PM svchost.exe 6128 TCP Send ITL-DC-SFTP-2.Contoso.lab.lan:2121 -> 172.21.12.104:50495 SUCCESS Length: 23, startime: 9113405, endtime: 9113405, seqnum: 0, connid: 0 NT AUTHORITY\SYSTEM
3:02:25.5988119 PM svchost.exe 6128 TCP Receive ITL-DC-SFTP-2.Contoso.lab.lan:2121 -> 172.21.12.104:50495 SUCCESS Length: 21, seqnum: 0, connid: 0 NT AUTHORITY\SYSTEM
3:02:25.5992702 PM svchost.exe 6128 CreateFile C:\FTPROOT\Contoso\abc.com\ PATH NOT FOUND Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, Impersonating: S-1-5-21-3402317017-4039385704-2910592383-7730 NT AUTHORITY\SYSTEM
3:02:25.6051110 PM svchost.exe 6128 TCP Send ITL-DC-SFTP-2.Contoso.lab.lan:2121 -> 172.21.12.104:50495 SUCCESS Length: 54, startime: 9113405, endtime: 9113406, seqnum: 0, connid: 0 NT AUTHORITY\SYSTEM
3:02:25.6051238 PM svchost.exe 6128 TCP Receive ITL-DC-SFTP-2.Contoso.lab.lan:2121 -> 172.21.12.104:50495 SUCCESS Length: 0, seqnum: 0, connid: 0 NT AUTHORITY\SYSTEM
3:02:25.6103687 PM svchost.exe 6128 TCP Disconnect ITL-DC-SFTP-2.Contoso.lab.lan:2121 -> 172.21.12.104:50495 SUCCESS Length: 0, seqnum: 0, connid: 0 NT AUTHORITY\SYSTEM
We went back and checked our configuration and found that we were giving user account details as "Contoso.xxxx.xxxxx.com\user" and path as “" C:\FTPROOT\ Contoso.xxxx.xxxxx.com\ abc\"
SVCHOST.exe is creating file and looking for Contoso path C:\FTPROOT\Contoso\abc\ and we were getting access denied as soon as the user isolation is enabled.
RESOLUTION:
We renamed the path to " C:\FTPROOT\Contoso\abc\ " and logged in with "Contoso\username (Contoso \abc)" and we were able to achieve user isolation and connection successfully.