Setting Up an FTP Server (Windows)

Overview

File Transfer Protocol (FTP) is a standard protocol used to transfer files between computers over a network. It uses a client-server architecture that allows users to upload, download, rename, delete, and view files and directory structures on a remote server. FTP supports two transfer modes:

• Active mode
  • The client sends commands to the server through the control connection (default port 21), and the server then actively connects to the port specified by the client through the data connection (default port 20) to transfer data.
  • This mode is suitable for client network environments without firewall restrictions. However, connection failures may occur if a firewall blocks the server's active connections.
• Passive mode
  • The client sends a PASV command through the control connection (port 21), and the server responds with a dynamic port (for example, 1024-65535). The client then actively connects to this port for data transfer.
  • This mode is suitable for scenarios where the client is located behind a firewall or NAT device, preventing server's active connections from being blocked.

    If other cloud servers on Huawei Cloud need to access the FTP server deployed on the FlexusL instance in this example over an EIP, passive mode must be used.

This section describes how to set up an FTP server on a FlexusL instance running Windows Server 2019.

Process

To set up an FTP server on a Windows FlexusL instance, perform the following steps:

1. 1
2. 2
3. 3
4. 4
5. 5
6. 6
7. 7
8. 8

Prerequisites

You have purchased a FlexusL instance running Windows and the instance is in the running state.

Procedure

1. Remotely log in to the FlexusL instance.
   1. Log in to the FlexusL console.
   2. On the target resource card, choose > Reset Password to reset the password as instructed.

      A FlexusL instance does not have an initial password. If you want to log in to a FlexusL instance, set a password for it first. If you have already set a password, skip this step.

      For details, see Resetting the Password for a FlexusL Instance.

   3. Locate the target resource card and click Remote Login. In the displayed dialog box, click VNC Login and enter the username and password to log in to the FlexusL instance. The username is root, and the password is the one you set in the previous step.

      For more login methods, see Login Modes.

2. Add the IIS and FTP service roles.
   1. Choose Start > Server Manager.
   2. Click Add roles and features.

      

   3. In the Before you Begin dialog box, click Next.
   4. Select Role-based or feature-based installation and click Next.

      

   5. Select the ECS where FTP is to be deployed and click Next.

      

   6. Select Web Server (IIS). In the displayed dialog box, click Add Features and then Next.

      

   7. Click Next until the Role Services page is displayed.
   8. Select FTP Server and IIS Management Console. Then, click Next.

      

   9. Click Install to assign the service roles.
   10. After the installation is complete, click Close.

3. Create a username and password.

   The Windows username and password are used for FTP. If you allow anonymous users to access FTP, you do not need to create an FTP username and password.

   1. In Server Manager, choose Dashboard > Tools > Computer Management.

      

   2. Choose System Tools > Local Users and Groups > Users, right-click the blank area on the right, and choose New User from the shortcut menu.

      

   3. Set User name (ftpadmin is used as an example) and Password.

      

   4. Click Create.

4. Assign permissions to the shared files.

   Set access and edit permissions for the files shared to users on the FTP site.

   1. Create a folder for FTP on the ECS, right-click the folder, and choose Properties from the shortcut menu.

      The work01 folder is used as an example and it contains the test.txt file to be shared.

   2. On the Security tab, select Everyone and click Edit.

      If Everyone is not displayed, add it by referring to How Do I Add the Everyone User?

      

   3. Select Everyone, assign permissions as needed, and click OK.

      In this example, all permissions are allowed.

      

5. Add and configure an FTP site.
   1. In Server Manager, choose Dashboard > Tools > Internet Information Services (IIS) Manager.

      

   2. In Server Manager, choose Dashboard > Tools > Internet Information Services (IIS) Manager.

      

   3. In the displayed dialog box, set the FTP site name and the physical path in which the shared folder is stored. Then, click Next.

      Site name FTPSERVER is used as an example.

      

   4. Enter the private IP address and port number of the FlexusL instance, set SSL, and click Next.
      • The default port number is 21. You can also set it as required.
      • Set SSL as required.
        • No SSL: SSL encryption is not required.
        • Allow SSL: Non-SSL and SSL connections between the FTP server and the client are allowed.
        • Require SSL: SSL encryption is required for the communication between the FTP server and the client.
          

          When Allow SSL or Require SSL is selected, an SSL certificate is required. You can select an existing SSL certificate or create a new one. For details, see How Do I Create a Server Certificate?

        

   5. Configure authentication and authorization and click Finish.
      • Identity authentication
        • Anonymous: allows any user with username anonymous or ftp to access.
        • Basic: allows only users with authorized usernames and passwords to access. However, the passwords transmitted over the network are not encrypted. You are advised to use this authentication method after confirming that the network connection between the client and the FTP server is secure.
      • Authorization
        • Allow access to:
          • All users: All users are allowed.
          • Anonymous users: Anonymous users are allowed.
          • Specified roles or user groups: Only specified roles or user group members are allowed. If you select this option, you are required to enter the specified roles or user groups in the text box.
          • Specified users: Only specified users are allowed. If you select this option, you are required to enter the specified users in the text box.
        • Permissions: specifies permissions for the authorized users.

      

6. (Optional) Configure the FTP firewall support.
   • If you need to use the FTP passive mode, configure the FTP firewall support.
   • If a server on Huawei Cloud, such as another FlexusL instance, needs to access the FTP server deployed on the FlexusL instance in this example over an EIP, configure the FTP firewall support.
   1. Double-click FTP Firewall Support.

      

   2. Configure parameters and click Apply.
      • Data Channel Port Range: specifies the range of ports used for passive connections. The valid port range is 1025 to 65535, for example, 5000 to 6000. Set this parameter based on site requirements.
      • External IP Address of Firewall: specifies the EIP of the FlexusL instance (where the FTP server resides).

      

   3. Restart the cloud server for the firewall configuration to take effect.

7. Configure security groups.

   After the FTP site is set up, add inbound rules to the security group of the FlexusL instance to allow access to the FTP port. For details, see Configuring Security Group Rules for a FlexusL Instance. For details about the ports to be allowed, see Table 1.

   If FTP Firewall Support is configured, you must allow the ports used by the FTP site and the data channel ports used by the FTP firewall in the security group.

   By default, the server firewall allows TCP port 21 for the FTP service. If you use another port, you must add the inbound rules to the firewall to allow traffic on that port.

   Table 1 Security group rules

   Priority	Action	Type	Protocol & Port	Source
   1	Allow	IPv4	TCP (Custom ports): 20-21	0.0.0.0/0
   1	Allow	IPv4	TCP (Custom ports): ports within 1024-65535 (for example, 5000-6000)	0.0.0.0/0

   

   If the source of an inbound rule is set to 0.0.0.0/0 or ::/0, then all external IP addresses are either allowed or denied to access your instances, depending on if the action is Allow or Deny. If the access is allowed, exposing ports to the public network poses security risks, such as network intrusions, service disruptions, data leaks, and ransomware attacks. It is recommended that you set security group rules to allow access only from trusted IP addresses, such as the IP address of the client that needs to access the FTP server in the next step.

8. Test the client.

   Open a client computer, which can be a local Windows computer or another Windows cloud server, and enter ftp://<FTP-server-public-IP-address>:<FTP-port> in the path bar. In this example, <FTP-server-public-IP-address> is the EIP of the FlexusL instance. If you do not specify the FTP port, port 21 is used by default.

   If a dialog box prompting for a username and password appears, the configuration is successful. After entering the correct username and password, you can perform operations on FTP files based on your assigned permissions.

   

   If FTP Firewall Support is not configured, configure the Internet Explorer browser. Otherwise, the FTP folder cannot be accessed. To configure the Internet Explorer browser, choose Tools > Internet Options > Advanced, select Enable FTP folder view, and deselect Use Passive FTP.

   

   You can also download FileZilla from the client to transfer files.

FAQs

For more information about setting up an FTP site on a Windows ECS, see official Microsoft documents.