FTP restrict user access to a specific folder

Question

I have created a FTP Site inside IIS 7.5 panel. Now I have access to whole site using administrator username and password.

Now, I want to let my friend access a specific folder of that FTP site. (for example, this path: \some\folder\accessible\)

I can't create a whole new FTP Site for this purpose, since it says the port is being used by another website.

How to create an account for my friend to have access to just an specific folder?

P.S: I have read about User Isolation feature of IIS 7.5, but I couldn't find how to create a user just for FTP and set it to a custom path.

Solution

I've finally solved this problem. Here is what I did:

1. Configure FTP with IIS Manager Authentication (I've pointed my FTP site to empty folder C:\inetpub\ftproot which was empty)

2. In IIS Control panel, select your FTP Site and then double click on FTP User Isolation.

3. Select User name directory and click Apply.

4. Now right click on the FTP Site, click Create new Virtual directory.

5. Set the alias to the IIS Manager user name that you created in step 1, and set its physical path to everywhere you want that user to have access.

6. Click OK.

Now that IIS manager user is able to access the folder you wanted via FTP, and he'll not have access to any other place.

Please note that you should repeat steps 1-6 for each user. (Step 1, from CONFIGURE THE IIS MANAGEMENT SERVICE AND ADD AN IIS 7 MANAGER part to the end of that page, then steps 2-6)

Comments

[Mahdi Ghiasi]

So, let user see (and modify) just a subfolder is not possible in IIS7.5?

[rws907]

Not if they don't have at least read rights to the parent folder. If they do, technically you could tell them that they have to configure the path exactly but you're putting a lot of trust that the user a) knows how to do that and b) is trustworthy.

[MDMarra]

@rsmith84 you can do all of that with FTP 7.5 services.

[MDMarra]

Future visitors should note that you can accomplish the same thing with a Windows user account and NTFS ACLs as well.

[rws907]

Learn something new everyday.

[Jey DWork]

I want to add that it seems to be required with windows accounts to have a (virtual) directory called 'LocalUser' in your root which in turn has (virtual) directories matching the user names with access. If you are in an AD instead of 'LocalUser' you have to name the folder according to your domain name and when your domain is mydomain.com the folder has to be named 'MYDOMAIN'. As this seems a bit cloudy another tip is to look in Sysinternals Process Monitor and here file system activity from svchost.exe during an attempted user logon to get the actual path the server is looking for.