Publishing FTPS on TMG 2010.

For instructions on creating FTP site on IIS read this post - Creating FTP or FTPS on IIS 8.5 (with Active Directory User isolation).

 

I. Configure FTP for Firewall Support (IIS 8.5)

1. Open IIS Manager, in connections pane select your FTPS server and in Features View double click FTP Firewall Support

 

 2. Enter port range for Data Channel for example we will be using 50100-50200. Also enter external IP of your firewall in this example yyy.yyy.yyy.yyy and in Actions pane click Apply.

Note: do not forget to allow this port range on your FTPS servers windows firewall, if it is not added automatically.

 

3. Repeat same step on FTP site level. Select your FTP site and in Feature View double click FTP Firewall Support.

 

 4. Data Channel Port Range should be greyed out with the value you specified earlier. For External IP Address of Firewall enter your firewalls external IP: yyy.yyy.yyy.yyy and in Actions pane click Apply.

 

 

II. Create Publishing rule on TMG

1. Open Forefront TMG console, right click Firewall Policy and choose New->Create new Non-Web Server Protocol Publishing Rule...

 

 

2. Enter the name of your FTPS rule for example "FTPS" and click Next

 

3. Enter IP address of your FTPS server

 

3. Click New... to create new protocol definition

 

4. Specify name for you protocol definition for example "FTPS Custom" and click Next

 

4. Click New to add port range for your protocol definition

 

 

 

5. Specify the following

Protocol type: TCP

Direction: Inbound

Port Range: From: 21 To: 21

and click OK

 

6. In New Protocol Definition Wizard click New one more time to add port range for data channel we specified in step I.2.

Specify the following

Protocol type: TCP

Direction: Inbound

Port Range: From: 50100 To: 50200

and click OK

 

7. Check if protocol configuration is fine and click Next

 

8. On following step leave the default No selected and click Next

 

9. Double check the settings and click Finish

 

10. After protocol definition has been created we can proceed with the rule. Click Next

 

11. Select checkbox next to External network and click Address... to specify external IP on which the FTPS service rule will be listening

 

12. Select Specified IP addressess on the Forefront TMG computer in the selected network and add the IP you specified in step I.2 (in this example yyy.yyy.yyy.yyy). After that click OK

 

13. Click Next to proceed

 

14. Click Finish to end the Publishing Rule Wizard

 15. Click Apply in TMG console and then click OK. Wait a few minutes and you are ready to test your FTPS server from external client.

 

 

 

 Links:

 

 http://www.isaserver.org/articles-tutorials/configuration-security/secure-file-transfer-microsoft-ftp-over-ssl-and-forefront-threat-management-gateway-tmg-2010.html

 

 

 

 

Creating FTP or FTPS on IIS 8.5 (with Active Directory User isolation).

The goal of this article is to describe how to create FTP(S) on IIS  so we can use Active Directory accounts to authenticate to FTP. And configure AD user isolation, so  the users have individual home folders.

 

1. Install IIS Role and required features

 

In Server Manager click on Add roles and features

Click Next

Installation Type - choose Role-based or feature-based installation and click Next

Server Selection - choose your server and click Next

Server Roles - select Web Server (IIS) and confirm required features by clicking Add Features in the popup window, click Next

In the Features and Web Server Role (IIS) sections click Next

Role Services - deselect the roles you don't need, if it's going to be dedicated FTP server then leave only FTP Server/FTP Service and Management Tools/IIS management Console selected and click Next

Confirmation - click Install

 

2. Create FTP users and Groups

In active directory create your FTP users for example:

FTPuser1

FTPuser2

FTPuser3

 

And create FTP users security group:

FTP Users

 

Add all ftp users to the membership of "FTP Users" group.

 

3. Create folders and assign permissions

Prepare folder structure on your preferred location. In this example we will be using Fileserver as FTP root so users can access ftp folders directly via file share while they are connected to company network.

 

Share a folder on Fileserver

\\Fileserver\FTProot\

Set sharing permissions for group "FTP Users" to Full Control.

Set NTFS permissions (security tab) for "FTP Users" group to List folder contents.

 

Next we will create home folder for every user group that needs to be isolated.

For example users FTPuser1 and FTPuser2 will share same home folder, because they are colleagues and are working with the same data and FTPuser3 is from another department, so he will have separate home folder.

 

\\Fileserver\FTProot\Home1

Add security permissions for users FTPuser1 and FTPuser2 and set them to Modify

 

\\Fileserver\FTProot\Home2

Add security permissions for user FTPuser3 and set them to Modify

 

4. Configure IIS

Open IIS Manager in Control Panel->Administrative Tools->Internet Information Services (IIS) Manager

 

In IIS Manager expand your server, right click Sites and choose Add FTP Site...

Enter site name: myFTP

Physical path: \\Fileserver\FTProot

 

If you want to run FTPS select Require SSL and select your SSL Certificate, otherwise select No SSL.

 

 

Authentication:

Basic

Auhorization:

Select Specified roles or user groups from drop-down menu.

Type FTP Users.

Select Read and Write checkboxes.

Click Finish.

 

Next configure FTP User Isolation.

Under myFTP site open FTP User Isolation.

Select Isolate users. Restrict users to the following directory:

FTP home directory configured in Active Directory

and enter credentials of user that has access to read AD properties.

 

5. Configure user AD properties

Open Active Directory Users and Computers (ADUC) and modify properties for your FTPusers.

To be able to modify attributes, first in ADUC select View and turn on Advanced Features.

Now you should see Attribute Editor tab in user properties.

Configure AD properties as follows:

 

FTPuser1

msIIS-FTPDir: \Home1

msIIS-FTPRoot: \\Fileserver\FTProot\

 

FTPuser2

msIIS-FTPDir: \Home1

msIIS-FTPRoot: \\Fileserver\FTProot\

 

FTPuser3

msIIS-FTPDir: \Home2

msIIS-FTPRoot: \\Fileserver\FTProot\

 

6. Login

For testing login we will use FileZilla FTP client.

Configure connection as follows.

Host: address of your FTP server

Protocol: FTP File Transfer Protocol

Port: 21

Encryption: if your FTP requires SSL select Require explicit FTP over TLS, otherwise select Only use plain FTP (insecure)

Logon type: Ask for password

User: FTPuser1

 

Click Connect, enter your password and click OK.

 

 

7. Conclusion

If everything went to plan users FTPuser1 and FTPuser2 should login to \\Fileserver\FTProot\Home1 folder and user FTPuser3 should login to \\Fileserver\FTProot\Home2.

 

Next - Publishing FTPS on TMG 2010.

 

Links:

https://social.technet.microsoft.com/Forums/windowsserver/en-US/0f499dee-19ca-495b-92ab-295caaf26d6d/help-needed-about-ftp-home-directory-configured-in-active-directory-?forum=winserverNIS

https://technet.microsoft.com/en-us/library/hh831655.aspx

http://winscp.net/eng/docs/guide_windows_ftps_server