Как настроить ftp сервер на windows server 2012 r2
Last updated on: 2020-10-16
Authored by: Rackspace Support
This article describes how to install the File Transfer Protocol (FTP) on Windows® Server® 2012 (R2).
Installation Requirements
Before you install FTP, you must add the IIS 8.x role to the Windows Server 2012 (R2) instance. If you have previously installed the IIS role without FTP support, this article walks you through setting it up.
Installing FTP on Windows Server 2012 (R2)
Use the following steps to install FTP:
Open the Server Manager from the taskbar.
From the Server Manager Dashboard, click Add Roles and Features.
From the Installation Type section, select Role-based or feature-based installation and click Next.
Note: Roles are the major feature sets of the server, such as IIS, and features provide additional functionality for a given role.
The current server is selected by default. Click Next to move to the Server Roles selection tab.
From the Server Roles tab, expand the Web Server (IIS) dropdown and place a check in the box for FTP Server. Click Next to move to the Features selection tab.
Select any additional features desired for your IIS deployment and click Next.
Note: You can also add these features at any point in the future through the setup wizard. A brief description of each feature displays on the right-hand pane of the wizard. Select a feature to read its description. See official Microsoft® documentation to learn more about each feature.
Review your installation and click Install.
A progress bar shows you the status of the installation. When the installation is complete, the wizard displays a success notification.
Share this information:
©2020 Rackspace US, Inc.
Except where otherwise noted, content on this site is licensed under a Creative Commons Attribution-NonCommercial-NoDerivs 3.0 Unported License
How to Configure an FTP server on Windows server 2012 R2
FTP stands for file transfer protocol and it works on a client-server model. The server hosts the files to be shared and the client provides the interface to access, download, or upload files to the file server. The computers transferring the files can be within the same network where the FTP server is configured, as well as outside the network (over the Internet). FTP uses two ports, one for connection and one for sending data.
Working Concept:
FTP can run in two modes: active and passive. And, it uses two channels between the client and server: the command channel and the data channel. The command channel is for sending the commands and responses, and the data channel is for sending the actual data. As for the active and passive modes, in the active mode, the client launches the command channel, and the server establishes the data channel. In the passive mode, both the command and data channels are established by the client.
Prerequisites
- A Windows 2012 R2 server.
- An administrative account.
Here you have the steps I followed to set up my FTP server in Windows 2012 R2.
The steps below assume you are using IIS 8.5 that comes by default with Windows 2012 R2.
- Login to the server and open the server manager, here click on Add Roles and Features:
- Now it will open the wizard to install the FTP Roles on this server:
3. Click next to move further and Keep this installation type as selected below:
4. Now click next and select the server as we have the host server selected here by default:
5. Now click next and move further to put a checkmark on FTP server, FTP Service and FTP Extensibility:
6. Now click on next and move further :
7. Now following roles will be installed on this server, Click next to install:
8. Now you can see the progress, FTP role and its service have been installed on this server, you may reboot this server.
9. Now we will configure the FTP site, click on the search box and open the IIS manager:
10. On the left side, you will find an option for “Site”, Right-click over site and click on Add FTP site:
11. After adding FTP site it will prompt you to fill some details about the site:
Enter the site name and create a folder to store the data and put the location under the physical path:
12. Here are you can select the option to use SSL or without SSL, I have selected no SSL:
13. Now Select the Authentication and Authorization information or you can change it later also and finish the setup.
14. Here you can change the FTP authorization rule if you want:
15. We can add user and give them permission to access the FTP site.
16. Here we have allows all users to get the access to the FTP site:
17. Now check the server IP address using command ipconfig:
18. Browse the IP on internet explorer as shown below :
Example: ftp:// 10.10.1.111
19. As you can see blow here is a folder and file which I have shared with the client and it is accessible using FTP, you may also access this from outside if you have allowed ftp travel on the firewall.
Configuring an FTP Server with User Isolation on Windows Server 2016 / 2012 R2
The FTP protocol is one of the oldest protocols (it is more than 40 years old), but it is still widely used where a simple file transfer protocol is required. It is possible to install an FTP server on any version of Microsoft operation system. Last deep modernization of the ftp service was made in Windows 7 / Server 2008 R2 (actually the service code has almost been written from scratch). The security of the service has significantly improved and a number of new features have appeared. In particular, FTP server on Windows allows you to configure FTP user isolation. It allows to restrict access of many users to their own folders on a single FTP server.
Due to the isolation, users can work only with their folders and can’t go up in the FTP directory tree (the user’s top ftp level directory is displayed as the root of the FTP server). Thus, the access to the data of other users on the FTP server can be prevented. FTP user isolation is widely used by ISP/hosting providers when it is necessary to provide individual access to a single file storage for different users.
Like in previous Windows versions, the FTP service in Windows Server 2016 / 2012 R2 (do not confuse it with sFTP and TFTP) is based and deeply integrated into the IIS service and has a single administrative management interface.
In this article we’ll show how to install an IIS-based FTP server on Windows Server 2016/2012 R2 and configure the FTP user isolation (this manual also applies to Windows 10 and 8.1).
How to Install the FTP Server Role on Windows Server 2016/ 2012 R2?
You can install the FTP service using the Server Manager console by checking the option FTP Service and FTP Extensibility in the section Web Server (IIS) -> FTP Server.
Also you can install the FTP server role with a single PowerShell command:
Install-WindowsFeature Web-FTP-Server
To install the FTP server management console, run the following command:
Install-WindowsFeature -Name «Web-Mgmt-Console»
Creating an FTP Site, Managing FTP User Permissions
Start the Server Manager and open the IIS management console (Internet Information Service Manager).
Create a new FTP site (Sites -> Add FTP Site).
The name of the FTP site: MyTestSite
The root directory of the FTP site: C:\inetpub\ftproot
To protect the FTP data transmitted over the network, it is possible to configure FTPS/SSL for FTP (in this case, all the data and passwords/accounts sent by ftp users during session will be encrypted), but in our demonstration this is not necessary. All other settings are left default.
Import-Module WebAdministration
# Set the FTP site name
$FTPSiteName = ‘CORP_FTP’
#FTP folder
$FTPRoot = ‘D:\www\FTPRoot’
#FTP port
$FTPPort = 21
New-WebFtpSite -Name $FTPSiteName -PhysicalPath $FTPRoot -Port $FTPPort
Select a new FTP site and disable the Anonymous Authentication in the FTP Authentication section. Basic Authentication must be enabled.
The FTP service on Windows Server 2016/2012 R2 can use two account types: domain or local. Depending on the account type, there are some differences in the structure of FTP directories and user isolation settings. To make it easier to describe, we will use local Windows accounts.
Create some FTP users, suppose, these are ftp_user1, ftp_user2 and ftp_user3. Also create a group ftp_users which includes these users. You can create local users in the Local Users and Groups section of the Computer Management console.
You can also create local users and groups from the command prompt (or using PowerShell). Create a local group:
net localgroup ftp_users /add
Create a new local user:
net user ftp_user1 /add *
Add user to group:
net localgroup ftp_users ftp_user1 /add
Create the two other users in the same way.
Assign the Read&Write permissions on the directory C:\inetpub\ftproot for the ftp_users group.
Create a directory with the name LocalUser (the name must be the same, it’s important. ) in the folder C:\inetpub\ftproot. Then make three directories under with the names ftp_user1, ftp_user2, ftp_user3 in the folder C:\inetpub\ftproot\LocalUser.
| Account Type | Syntax of Home Directory Naming |
| Anonymous users | %FtpRoot%\LocalUser\Public |
| Local Windows account | %FtpRoot%\LocalUser\%UserName% |
| Domain Windows account | %FtpRoot%\%UserDomain%\%UserName% |
| Special IIS Manager or ASP.NET accounts | %FtpRoot%\LocalUser\%UserName% |
Return to the IIS console and create a new rule (Add AllowRules) in FTP Authorization Rules section of the site. Specify that ftp_users group must have the read and write permisions.
How to Configure FTP User Isolation on Windows Server 2016/2012 R2?
Let’s move to configuring FTP user isolation. The isolation of FTP users is configured on the FTP site level, not the entire server. FTP user isolation allows you to organize your ftp-home folder for each user.
Open FTP User Isolation in the settings of the FTP site.
This section contains several settings. The first two of them don’t suggest user isolation:
- FTP root directory (an FTP session of a user starts in the root directory of the FTP site);
- User name directory (the user starts with physical/virtual directory with the username. If the directory is missing, a session starts in the root FTP directory of the site).
The next three options are different modes of user isolation:
- User name directory (disable global virtual directories) suggests that the ftp session of a user is isolated in a physical/virtual directory that has the same name as the ftp user. Users see only their own directory (it is their root ftp-directory) and cannot go beyond it (to the upper directory of the FTP tree). Any global virtual directories are ignored;
- User name physical directory (enable global virtual directories) suggests that the ftp session of a user is isolated in a physical directory that has the same name as the name of the ftp user account. A user cannot go above its directory. However, all created global virtual directories are available to the user;
- FTP home directory configured in Active Directory – an FTP user is isolated within his home directory specified in the settings of his Active Directory account (FTPRoot and FTPDir properties).
Select the required isolation mode (I use the second option to isolate ftp users).
Configuring Windows Firewall Rules to Access the FTP Server
When you install the FTP server role, all necessary rules that are needed for users to access FTP are automatically activated in the Windows Firewall settings.
For FTP to work correctly in passive FTP mode, users need to connect to the RPC port range (1025-65535). In order not to open all these ports on an external firewall, you can limit the range of dynamic TCP ports used for FTP data transmission.
- Open the FTP Firewall Support section in FTP site settings and in the Data Channel Port Range field specify the port range that you want to use for FTP connections. For example – 50000-50100;
- Save the changes and restart IIS ( iisreset );
- Open the Windows Control Panel and go to the Control Panel\System and Security\Windows Firewall\Allowed apps;
- Make sure that the list of applications that are allowed access through the firewall contains permissions for the FTP Server role.
Then check that the following rules are enabled in the settings of Windows Firewall with Advanced Security:
- FTP Server (FTP Traffic-In) – TCP protocol, port 21;
- FTP Server Passive (FTP Passive Traffic-In) – local port address 1024-65535 (50000-50100 in our case);
- FTP Server Secure (FTP SSL Traffic-In) –port 990 (when using FTP with SSL);
- FTP Server (FTP Traffic-Out) – port 20;
- FTP Server Secure (FTP SSL Traffic-Out) –port 989 (when using FTP with SSL).
Accordingly, these ports need to be opened on your router (gateway, firewall) so that external FTP users can connect to your site.
Testing an FTP Server Connection from Windows
You can check the availability of ports on an FTP server using the Test-NetConnection cmdlet:
Test-NetConnection -ComputerName yourftpservername -Port 21
Or using the ftp command:
Try to connect to your FTP site with any FTP client or directly from File Explorer (specify ftp://yourservername/ in the address bar).
Enter the user name and password.
And now you have access to the home directory with the user’s files (which is the root of the FTP site for the user). As we can see, the user session is isolated and the user sees only his files on the ftp server.
You can use FTP logs to view information about user access to the FTP server. The log files are stored by default in the c:\inetpub\logs\logfiles folder in the u_exYYMMDD.log files.
To view the active user connections to your FTP server, you can use the values of the IIS performance counters through PowerShell or the “Current FTP Sessions” section in the IIS console. In this console, you can view the names and the IP address of the FTP user’s and disconnect the ftp-session if necessary.
So, we have looked at how to configure an FTP site with the user isolation based on Windows Server 2016 / 2012 R2. In the isolation mode the users are authenticated on FTP using their local or domain credentials to access their root directory corresponding to the username.
Настройка FTP-сервера в Windows Server 2012
FTP (File Transfer Protocol) — протокол передачи файлов. Применяется для передачи файлов клиентами локальной сети, а также для загрузки данных на локальные и удаленные хранилища.
Рассмотрим настройку FTP-сервера из набора IIS от компании Microsoft, создание самоподписанного сертификата, а также настройку защищенной передачи файлов.
Операционная система — Windows Server 2012 R2.
Установим Веб-сервер IIS
Запускаем Диспетчер серверов из меню Пуск или кликом по значку на панели задач.
Выбираем пункт Добавить роли и компоненты.
В новом окне выбираем, слева, Тип установки, затем Установка ролей или компонентов, кликаем по кнопке Далее.
Из предложенного пула серверов выбираем необходимый. В нашем случае он один, кликаем Далее.
В списке ролей находим Веб-сервер (IIS) и ставим галочку напротив этого пункта.
В новом окне Мастер добавления ролей и компонентов просто кликаем по Добавить компоненты. Данное окно обычно появляется при первой установке Веб-сервера (IIS). Кликаем Далее.
Слева кликаем по Служба ролей (подпункт Роль Веб-сервера (IIS)). Ставим галку напротив FTP-сервер. При необходимости устанавливаем галку напротив Расширяемость FTP. Кликаем Далее.
Проверяем компоненты для установки. При первой установке, рекомендуем установить галку в поле Автоматический перезапуск конечного сервера, если потребуется. Кликаем Установить. Важно! При первой установке Веб-сервера (IIS) будут установлены дополнительные компоненты службы.
Ожидаем завершения процесса установки. По окончании кликаем Закрыть.
Переходим к настройке сервера.
1. Открываем Администрирование. Можно из меню Пуск, но если там отсутствует этот пункт, то Пуск -> Панель управления -> Система и безопасность — > Администрирование
2. Запускаем Диспетчер служб IIS
3. В открывшемся окне, в левой части, разворачиваем ветку под необходимым сервером. Кликаем правой кнопкой мыши по элементу Сайты и выбираем пункт Добавить FTP-сайт…
4. В новом окне Добавить FTP-сайт указываем имя и путь до каталога где будут расположены файлы. Кликаем Далее.
5. В обновленном окне указываем на каких IP-адресах будет запущен FTP-сервер (актуально, когда у сервера несколько сетевых интерфейсов либо алиасов), а также указываем порт, который будет прослушивать служба (по умолчанию 21 TCP-порт). Проверяем наличие галочки Запускать сайт FTP автоматически. В настройках SSL указываем Без SSL. Если требуется шифрование, тогда выбираем соответствующий пункт и указываем сертификат. Кликаем Далее.
6. Следующим этапом настраиваем аутентификацию. В разделе Проверка подлинности выбираем Обычный (если требуется анонимное предоставление доступа следует выбрать Анонимный). В разделе Авторизация можно гибко указать доступ для пользователей. В нашем примере разрешим доступ Всем пользователям, кроме анонимных. Разрешаем чтение и запись. Кликаем Готово.
7. В случае успешности, в окне Диспетчера служб IIS добавится строка с именем добавленного FTP-сервера (сайта). Сворачиваем или закрываем это окно. Оно нам более не понадобится.
Настраиваем брандмауэр.
1. В окне Администрирование открываем Брандмауэр Windows в режиме повышенной безопасности.
2. В открывшемся окне, в левой части, выбираем Правила для входящих подключений. В правой части кликаем по Создать правило.
3. В новом окне выбираем Предопределенные. Из выпадающего списка выбираем FTP-сервер. Кликаем Далее.
4. Отмечаем галочками все пункты, кликаем Далее.
5. Следующим шагом выбираем Разрешить подключение, кликаем Готово.
Выбранные правила будут добавлены в общий список правил входящих подключений. Для применения настроек брандмауэра следует перезагрузить сервер.
Подключиться к серверу можно любым FTP-клиентом указав IP-адрес сервера, имя пользователя и пароль, например FileZilla. Однако, доступность сервера можно проверить и с помощью Internet Explorer. В строке адреса указываем ftp://IP.адрес.нашего.сервера/ (либо доменное имя). Указываем имя пользователя и пароль.
Настройка защищенного (Secure) FTP.
Для защиты трафика рекомендуется использовать SSL-сертификаты. Можно использовать самоподписанные сертификаты либо выданные центром сертификации. Обратите внимание, что при подключении к серверу с самоподписанным сертификатом пользователь будет уведомлен об этом.
Создадим самоподписанный сертификат.
1. Запускаем Диспетчер служб IIS (см. выше Настройку сервера).
2. В открывшемся окне, в левой части, разворачиваем ветку под необходимым сервером. Выбираем Сертификаты сервера.
3. В новом окне, в правой части, выбираем Создать самозаверенный сертификат.
4. В открывшемся окне указываем имя сертификата и его тип — Личный. Кликаем Ок.
Сертификат создан. Теперь перейдем к настройке защищенного FTP.
1. В окне Диспетчер служб IIS, в левой части, разворачиваем ветку под необходимым сервером, выбираем созданный сервер. В основной части окна выбираем Параметры SSL FTP.
2. В обновленном окне, в выпадающем списке, выбираем созданный сертификат, либо выданный центром сертификации, если такой имеется. Выбираем Требовать SSL-соединения. В правой части окна выбираем Применить. Закрываем окно, если необходимо.
Для подключения к защищенному FTP-серверу рекомендуем использовать программу WinSCP.