IIS4 permissions dialog box upgrade?

**RowaN** · 10th February 2003

Using the GUI of IIS 4 (on NT4), if you change a permission on say d:\www\mcdonalds, it lets you either change JUST that folder, or all the subfolders.. but i dont want all the files in all the subfolders to have the same permissions as that directory.. i only want to ADD in one permission to whatever different permission exist throughout the various files and dirs on the site. i.e. give 1 user full ftp access without affecting anything else. Aparently theres some kind of security snap in and it upgrades the security permisions diaglog to be like the one in win2k. Any ideas what its called or where I can get it? Any help much appriciated. Thanks in advance. :love:

**graham.edmon** · 12th February 2003

not sure if I get what you mean.... so I will talk about what I think you mean...

1. under 2k.. you only have 1 user security context for FTP as you do under NT.....
2. Allocating permissions on a per user basis is not possible.. you need to disable MSFTP from the IIS console and install a 3rd party FTP server, U-Serv does what I think you want.

as for your underlying file permissions.. U-Serv has an AD function which would allow you to do what you are stating.. however.. I must state here.. that what you are trying to do is overcomplex and probably unnecessary.. Why are you trying to limit files within a single folder?

**RowaN** · 12th February 2003

I dont know what you mean by "limiting files".. but at present, if i take the root dir and say, add read/write permission for user "ronald", and "apply to existing files" - it will essentially wipe out existing permissions on files (whatever they might be) and replace with whatever permissions are set on the directory I just edited. Rather than just adding in this users permission to all files. So if theres a subdir which contains a txt file which has permission to be written by the public (i.e. by a pearl script), it will lose this permission and inherit whatever permissions were on the directory I just set. Bad news!

If I install U-Serv will it keep all the ftp accounts and file permissions intact?

Thanks.

**Aido** · 13th February 2003

Use cacls - that edits the ACL's instead of replacing them..

ie, cacls * /T /E /C /G ronald:c

The GUI's a pain in the ass for shit like this anyway...

Just make sure the users who need to access the FTP site are all granted log on locally rights and you'll be fine with IIS / MSFTPSVC

**RowaN** · 27th February 2003

> cacls * /T /E /C /G ronald:c

Can you explain that line - sorry lol.

How do I transfer the FTP accounts from MSFTP to Serv-U? Also, is there something special about Serv-U or can I use Bulletproof FTP Server (I'm familiar with that).

Thanks, I appreciate your help.

**Aido** · 27th February 2003

I'm only familiar with IIS so can't comment on the others mate but as for cacls here goes:

Code:

/T = Subdirs
/E = Edit existing permissions (ACL = access control list) as opposed to replacing
/C = Continue on access denied
/G user : permissions = Grant specified user relevant permissions, ie R=Read, W=Write, C=Change, F=Full Control

It basically lets you edit the existing permissions without overwriting the existing users, ie add another user without affecting anyone else..

To understand IIS security you really need to read up on NTFS permissions and understand how ACL's work, it's simple really.