Integrate FTP with Your Web Site

A reader recently sent me an e-mail with a few questions about integrating FTP on his Web site, which he hosts from his Windows XP Professional system. He couldn't find the answers he needed in his dog-eared copy of Windows XP Power Tools. What he wanted to accomplish was to provide a link on a Web page that pointed to his FTP site. Simple enough, but he also wanted the FTP server to prompt the user for authentication credentials rather than simply open the site with anonymous access. Not a bad plan, considering anonymous FTP is a horrible idea if you enable Write permission on the site. Just leave your doors and windows unlocked and wide open the next time you go on vacation-that's a lot like anonymous FTP.

However, you don't need to disable anonymous access on an FTP server to use authenticated access-you can use both on the server. For example, you might provide anonymous access to people who need to retrieve files from a public area of the site, but use authentication to secure other areas of the FTP server. You configure these properties using the IIS console in the Administrative Tools folder. Right-click the FTP site and choose Properties. Use the options on the Security Accounts tab to enable or disable anonymous access.

It's easy to force authentication for an FTP site that the user opens from a Web link. When you create the link, specify a URL similar to the following: ftp://someuser@ftp.boyce.us. When the user clicks the link, an authentication dialog box will appear with the user account already entered. The user enters the password and clicks OK to authenticate. If the specified user account matches the name of a virtual directory on the FTP server, that folder opens by default in the browser.

There's another option to consider if you need to provide access to folders and files for download by people who visit your Web site. You can create a virtual directory under your Web site and point that virtual directory to the folder containing the files and other folders. For example, you might point the virtual directory to the root folder for your FTP site. Then, configure the permissions for the virtual directory to enable the Browse permission. Make sure the target folders are located on an NTFS partition for security and create the user account(s) that remote users will specify when they are prompted to authenticate on the site. A virtual folder with Browse permission enabled works a lot like the old gopher servers, providing a listing of the folders and files in the target folder, each as a hyperlink. The user can click on a folder to drill down through the directory structure or click a file to open or download the file.

If you choose this latter method, make sure you turn off anonymous access for the virtual directory if you need to control who can view and download files from the folder. Also make sure you disable Write access in the virtual directory properties to prevent users from uploading files.

Jim