www.geekybob.com

Just a short, simple blog for Bob to share his thoughts.

How to determine if FTP clients are using FTPS

04 October 2011 • by Bob • FTP, LogParser

One of my colleagues here at Microsoft, Emmanuel Boersma, just reminded me of an email thread that we had several weeks ago, where a customer had asked him how they could tell if FTPS was being used on their FTP server. He had pointed out that when he looks at his FTP log files, the port number was always 21, so it wasn't as easy as looking at a website's log files and looking for port 80 for HTTP versus port 443 for HTTPS. I had sent him the following notes, and I thought that they might make a good blog. ;-)

As I mentioned earlier, we had discussed the control channel is typically over port 21 for both FTP and FTPS, so you can't rely on the port. But having said that, I mentioned that you will see certain verbs in your FTP logs that will let you know when FTPS is being used, and that’s a reliable way to check.

With that in mind, I suggested the following two methods that you can use to determine if FTPS is being used:

  • If the port number is something other than 990, and you see the following verbs being used (and succeeding), then Explicit FTPS is being used:
    • AUTH
    • PBSZ
    • PROT
  • If the port is 990, then Implicit FTPS is being used. (This means the FTPS is always on.)

For example, see the highlighted data in following FTP log file excerpts:

Explicit FTPS over port 21:

#Fields: date time c-ip cs-username cs-host s-ip s-port cs-method cs-uri-stem sc-status sc-win32-status sc-substatus sc-bytes cs-bytes time-taken
2011-06-30 22:11:24 ::1 - - ::1 21 ControlChannelOpened - - 0 0 0 0 0
2011-06-30 22:11:24 ::1 - - ::1 21 AUTH TLS 234 0 0 31 10 16
2011-06-30 22:11:27 ::1 - - ::1 21 PBSZ 0 200 0 0 69 8 0
2011-06-30 22:11:27 ::1 - - ::1 21 PROT P 200 0 0 69 8 0
2011-06-30 22:11:36 ::1 - - ::1 21 USER robert 331 0 0 69 13 0
2011-06-30 22:11:42 ::1 robert - ::1 21 PASS *** 230 0 0 53 15 2808

Implicit FTPS over port 990:

#Fields: date time c-ip cs-username cs-host s-ip s-port cs-method cs-uri-stem sc-status sc-win32-status sc-substatus sc-bytes cs-bytes time-taken
2011-06-30 22:16:55 ::1 - - ::1 990 ControlChannelOpened - - 0 0 0 0 0
2011-06-30 22:16:58 ::1 - - ::1 990 USER robert 331 0 0 69 13 0
2011-06-30 22:16:58 ::1 robert - ::1 990 PASS *** 230 0 0 53 15 78
2011-06-30 22:16:58 ::1 robert - ::1 990 SYST - 500 5 51 1005 6 0
2011-06-30 22:16:58 ::1 robert - ::1 990 FEAT - 211 0 0 313 6 0
2011-06-30 22:16:58 ::1 robert - ::1 990 OPTS UTF8+ON 200 0 0 85 14 0
2011-06-30 22:16:58 ::1 robert - ::1 990 PBSZ 0 200 0 0 69 8 0
2011-06-30 22:16:58 ::1 robert - ::1 990 PROT P 200 0 0 69 8 0

FWIW – An explanation about Implicit FTPS and Explicit FTPS can be found in the following articles:

Note: This blog was originally posted at http://blogs.msdn.com/robert_mcmurray/

How to Use Managed Code (C#) to Create an FTP Home Directory Provider for the Days of the Week

29 September 2011 • by Bob • FTP, Extensibility

I had a question from someone that had an interesting scenario: they had a series of reports that their manufacturing company generates on a daily basis, and they wanted to automate uploading those files over FTP from their factory to their headquarters. Their existing automation created report files with names like Widgets.log, Sprockets.log, Gadgets.log, etc.

But they had an additional request: they wanted the reports dropped into folders based on the day of the week. People in their headquarters could retrieve the reports from a share on their headquarters network where the FTP server would drop the files, and anyone could look at data from anytime within the past seven days.

This seemed like an extremely trivial script for me to write, so I threw together the following example batch file for them:

@echo off
pushd "C:\Reports"
for /f "usebackq delims= " %%a in (`date /t`) do (
  echo open MyServerName>ftpscript.txt
  echo MyUsername>>ftpscript.txt
  echo MyPassword>>ftpscript.txt
  echo mkdir %%a>>ftpscript.txt
  echo cd %%a>>ftpscript.txt
  echo asc>>ftpscript.txt
  echo prompt>>ftpscript.txt
  echo mput *.log>>ftpscript.txt
  echo bye>>ftpscript.txt
)
ftp.exe -s:ftpscript.txt
del ftpscript.txt
popd

This would have worked great for most scenarios, but they pointed out a few problems in their specific environment: manufacturing and headquarters were in different geographical regions of the world, therefore in different time zones, and they wanted the day of the week to be based on the day of the week where their headquarters was located. They also wanted to make sure that if anyone logged in over FTP, they would only see the reports for the current day, and they didn't want to take a chance that something might go wrong with the batch file and they might overwrite the logs from the wrong day.

With all of those requirements in mind, this was beginning to look like a problem for a custom home directory provider to tackle. Fortunately, this was a really easy home directory provider to write, and I thought that it might make a good blog.

Note: I wrote and tested the steps in this blog using both Visual Studio 2010 and Visual Studio 2008; if you use an different version of Visual Studio, some of the version-specific steps may need to be changed.

In This Blog

Prerequisites

The following items are required to complete the procedures in this blog:

  1. The following version of IIS must be installed on your Windows computer, and the Internet Information Services (IIS) Manager must also be installed:
    • IIS 7.0 must be installed on Windows Server 2008
    • IIS 7.5 must be installed on Windows Server 2008 R2 or Windows 7
  2. The new FTP 7.5 service must be installed. To install FTP 7.5, follow the instructions in the following topic:
  3. You must have FTP publishing enabled for a site. To create a new FTP site, follow the instructions in the following topic:
  4. You need to create the folders for the days of the week under your FTP root directory; for example, Sunday, Monday, Tuesday, etc.

Step 1: Set up the Project Environment

In this step, you will create a project in Microsoft Visual Studio for the demo provider.

  1. Open Visual Studio 2008 or Visual Studio 2010.
  2. Click the File menu, then New, then Project.
  3. In the New Projectdialog box:
    • Choose Visual C# as the project type.
    • Choose Class Library as the template.
    • Type FtpDayOfWeekHomeDirectory as the name of the project.
    • Click OK.
  4. When the project opens, add a reference path to the FTP extensibility library:
    • Click Project, and then click FtpDayOfWeekHomeDirectory Properties.
    • Click the Reference Paths tab.
    • Enter the path to the FTP extensibility assembly for your version of Windows, where C: is your operating system drive.
      • For Windows Server 2008 and Windows Vista:
        • C:\Windows\assembly\GAC_MSIL\Microsoft.Web.FtpServer\7.5.0.0__31bf3856ad364e35
      • For 32-bit Windows 7 and Windows Server 2008 R2:
        • C:\Program Files\Reference Assemblies\Microsoft\IIS
      • For 64-bit Windows 7 and Windows Server 2008 R2:
        • C:\Program Files (x86)\Reference Assemblies\Microsoft\IIS
    • Click Add Folder.
  5. Add a strong name key to the project:
    • Click Project, and then click FtpDayOfWeekHomeDirectory Properties.
    • Click the Signing tab.
    • Check the Sign the assembly check box.
    • Choose <New...> from the strong key name drop-down box.
    • Enter FtpDayOfWeekHomeDirectoryKey for the key file name.
    • If desired, enter a password for the key file; otherwise, clear the Protect my key file with a password check box.
    • Click OK.
  6. Note: FTP 7.5 Extensibility does not support the .NET Framework 4.0; if you are using Visual Studio 2010, or you have changed your default framework version, you may need to change the framework version for this project. To do so, use the following steps:
    • Click Project, and then click FtpDayOfWeekHomeDirectory Properties.
    • Click the Application tab.
    • Choose .NET Framework 3.5 in the Target framework drop-down menu.
    • Save, close, and re-open the project.
  7. Optional: You can add a custom build event to add the DLL automatically to the Global Assembly Cache (GAC) on your development computer:
    • Click Project, and then click FtpDayOfWeekHomeDirectory Properties.
    • Click the Build Events tab.
    • Enter the appropriate commands in the Post-build event command linedialog box, depending on your version of Visual Studio:
      • If you are using Visual Studio 2010:
        net stop ftpsvc
        call "%VS100COMNTOOLS%\vsvars32.bat">null
        gacutil.exe /if "$(TargetPath)"
        net start ftpsvc
      • If you are using Visual Studio 2008:
        net stop ftpsvc
        call "%VS90COMNTOOLS%\vsvars32.bat">null
        gacutil.exe /if "$(TargetPath)"
        net start ftpsvc
      Note: You need to be logged in as an administrator in order to restart the FTP service and add the dll to the Global Assembly Cache.
  8. Save the project.

Step 2: Create the Extensibility Class

In this step, you will implement the extensibility interfaces for the demo provider.

  1. Add the necessary references to the project:
    • Click Project, and then click Add Reference...
    • On the .NET tab, click Microsoft.Web.FtpServer.
    • Click OK.
  2. Add the code for the authentication class:
    • In Solution Explorer, double-click the Class1.cs file.
    • Remove the existing code.
    • Paste the following code into the editor: 
      using System;
using System.Collections.Generic;
using System.Collections.Specialized;
using Microsoft.Web.FtpServer;

public class FtpDayOfWeekHomeDirectory :
    BaseProvider,
    IFtpHomeDirectoryProvider
{
    // Store the path to the default FTP folder.
    private static string _defaultDirectory = string.Empty;

    // Override the default initialization method.
    protected override void Initialize(StringDictionary config)
    {
        // Retrieve the default directory path from configuration.
        _defaultDirectory = config["defaultDirectory"];
        // Test for the default home directory (Required).
        if (string.IsNullOrEmpty(_defaultDirectory))
        {
            throw new ArgumentException(
              "Missing default directory path in configuration.");
        }
    }

    // Define the home directory provider method.
    string IFtpHomeDirectoryProvider.GetUserHomeDirectoryData(
        string sessionId,
        string siteName,
        string userName)
    {
        // Return the path to the folder for the day of the week.
        return String.Format(
            @"{0}\{1}",
            _defaultDirectory,
            DateTime.Today.DayOfWeek);
    }
}
  3. Save and compile the project.

Note: If you did not use the optional steps to register the assemblies in the GAC, you will need to manually copy the assemblies to your IIS 7 computer and add the assemblies to the GAC using the Gacutil.exe tool. For more information, see the following topic on the Microsoft MSDN Web site:

Global Assembly Cache Tool (Gacutil.exe)

Step 3: Add the Demo Provider to FTP

In this step, you will add your provider to the global list of custom providers for your FTP service, configure your provider's settings, and enable your provider for an FTP site.

Adding your Provider to FTP

  1. Determine the assembly information for your extensibility provider:
    • In Windows Explorer, open your "C:\Windows\assembly" path, where C: is your operating system drive.
    • Locate the FtpDayOfWeekHomeDirectory assembly.
    • Right-click the assembly, and then click Properties.
    • Copy the Culture value; for example: Neutral.
    • Copy the Version number; for example: 1.0.0.0.
    • Copy the Public Key Token value; for example: 426f62526f636b73.
    • Click Cancel.
  2. Add the extensibility provider to the global list of FTP authentication providers:
    • Open the Internet Information Services (IIS) Manager.
    • Click your computer name in the Connections pane.
    • Double-click FTP Authentication in the main window.
    • Click Custom Providers... in the Actions pane.
    • Click Register.
    • Enter FtpDayOfWeekHomeDirectory for the provider Name.
    • Click Managed Provider (.NET).
    • Enter the assembly information for the extensibility provider using the information that you copied earlier. For example:
      FtpDayOfWeekHomeDirectory,FtpDayOfWeekHomeDirectory,version=1.0.0.0,Culture=neutral,PublicKeyToken=426f62526f636b73
    • Click OK.
    • Clear the FtpDayOfWeekHomeDirectory check box in the providers list.
    • Click OK.

Note: If you prefer, you could use the command line to add the provider to FTP by using syntax like the following example:

cd %SystemRoot%\System32\Inetsrv

appcmd.exe set config -section:system.ftpServer/providerDefinitions /+"[name='FtpDayOfWeekHomeDirectory',type='FtpDayOfWeekHomeDirectory,FtpDayOfWeekHomeDirectory,version=1.0.0.0,Culture=neutral,PublicKeyToken=426f62526f636b73']" /commit:apphost

Configuring your Provider's Settings

At the moment there is no user interface that allows you to configure properties for a custom home directory provider, so you will have to use the following command line:

cd %SystemRoot%\System32\Inetsrv

appcmd.exe set config -section:system.ftpServer/providerDefinitions /+"activation.[name='FtpDayOfWeekHomeDirectory']" /commit:apphost

appcmd.exe set config -section:system.ftpServer/providerDefinitions /+"activation.[name='FtpDayOfWeekHomeDirectory'].[key='defaultDirectory',value='C:\Inetpub\ftproot']" /commit:apphost

Note: The highlighted area contains the value that you need to update with the root directory of your FTP site.

Enabling your Provider for an FTP site

At the moment there is no user interface that allows you to enable a custom home directory provider for an FTP site, so you will have to use the following command line:

cd %SystemRoot%\System32\Inetsrv

appcmd.exe set config -section:system.applicationHost/sites /+"[name='My FTP Site'].ftpServer.customFeatures.providers.[name='FtpDayOfWeekHomeDirectory']" /commit:apphost

appcmd.exe set config -section:system.applicationHost/sites /"[name='My FTP Site'].ftpServer.userIsolation.mode:Custom" /commit:apphost

Note: The highlighted areas contain the name of the FTP site where you want to enable the custom home directory provider.

Summary

In this blog I showed you how to:

  • Create a project in Visual Studio 2010 or Visual Studio 2008 for a custom FTP home directory provider.
  • Implement the extensibility interface for custom FTP home directories.
  • Add a custom home directory provider to your FTP service.

When users connect to your FTP site, the FTP service will drop their session in the corresponding folder for the day of the week under the home directory for your FTP site, and they will not be able to change to the root directory or a directory for a different day of the week.

Note: This blog was originally posted at http://blogs.msdn.com/robert_mcmurray/

Proud Microsoft Dad Moments

23 September 2011 • by Bob • Family

This past August my middlest daughter married her fiancé in a small ceremony that was as unique as the two of them. That being said, one moment of entertainment occurred during the service when my daughter recited her self-composed vows by reading them from her Windows Phone.

As a Microsoft Dad, this was too amusing to keep to myself, so I forwarded a photo to some of the folks in the Windows Phone division, and the story was picked up by the Windows Blog team, which published my daughter's description of the event as "First Person: With this phone, I thee wed"

"The wedding was in a little white chapel, up against a mountain, near the ocean. We wanted a simple, elegant wedding that represented us. We went through all the different weddings we'd seen - do we want to mix the sand? light a unity candle? - but we decided that wasn't really us. So we cut out all the things that weren't really us, and wrote our own vows.

"My phone is the thing I always have on me, so when I needed to write my vows I used Office on my phone. Whenever I thought of something I wanted to add, I could just jot it down. When it came to the day of, I thought maybe I should write it on a piece of paper. Then the minister said, 'Why not just read it off your phone?'

"My husband didn't know I was going to read off my phone. He said his vows off paper, and when it was my turn I looked at the pastor and she pulled out my phone and handed it to me. Everyone laughed - it made it a little more lighthearted, so we weren't bawling.

"My husband laughed, because I'm on my phone all the time, and he's on his. So I'm sure he wished he had thought of it. Now the vows are saved on my phone, and every time I want to go back and read them, I can. Meanwhile, his piece of paper is floating around somewhere - I don't even know where it is."

(photo: ©Rebecca Calvo Photography)

The Decline and Fall of the American Empire

17 September 2011 • by Bob • History, Politics

When you study history, you are invariably introduced to Carroll Quigley's seven stages in The Evolution of Civilizations. In chapter 5 of his book, Quigley describes the seven states in the history of a civilization; these are:

  1. Mixture: The mixture of diverse, smaller societies to form a unique, larger whole.
  2. Gestation: The gestation of that large society, specifically in the development of a method for accumulating an economic surplus and investing it in methods of expansion.
  3. Expansion: A period of vigorous expansion in population, territory, technological competence, wealth, knowledge, etc.
  4. Conflict: A period of major conflict between societal elements or geographical areas within the civilization.
  5. Empire: The development of a universal empire ruling over the entire civilization, which far from being a golden age represents a precursor to decay and collapse.
  6. Decay: The decay of the civilization as exemplified in the ossification of institutions and structures within the empire.
  7. Collapse/Invasion: The collapse of the civilization, usually through invasion by a younger civilization that is in the expansion phase.

Every great civilization has gone through this formula - with no exceptions.

From my perspective, the history of the United States has emerged in the following way:

  1. Our Mixture phase was pre-1750s as European settlers began to arrive and colonize the East Coast.
  2. Gestation followed the 1750s through the early 1800s as the colonists won their independence from European rule and began to establish a new nation.
  3. Expansion was from the early 1800s through the 1860s as the new nation pushed west toward the Pacific Ocean.
  4. Conflict was from 1860s through the latter 1890s as the United States grappled with the Civil War and its aftermath.
  5. Empire was from the early 1900s through the latter 1950s as the reunified United States fought a series of World Wars and established itself as a dominant world power.
  6. Decay began in the late 1950s and early 1960s as the generation born during the post-WWII Baby Boom spat on the prosperity that had been fought for and freely given to them, and all vestiges of ethical and moral standards were removed from public education. This period was marked by dramatic rises in crime rates, drug proliferation, corruption, divorce, unemployment, abortions-on-demand, corporate greed, and worst of all - the political ineptitude which prevents anything from being done about it.

According to Mr. Quigley's formula, all that the United States have left to face are Collapse and Invasion; civilizations do not recover once they have entered the Decay phase.

What is tragically ironic is that the people who vociferously claim to be trying to save the United States, namely Progressives and Liberals, are actually doing the most damage. As Quigley illustrates in his book, when members of a civilization become so preoccupied with arguing about what they perceive are their "rights" instead of contributing to society and adhering to an ethical set of standards or morals, the fabric of civilization unravels, and eventually implodes as an emerging civilization invades and conquers.

In this present day and age, people are rushing headlong into their inevitable demise; all the while they are wearing blinders which prevent them from seeing what is obvious to the less-outspoken of their peers. It is a sad manifestation of The Emperor's New Clothes; and even though the irony is missed by those who are too foolish to see themselves as members of the deceived, future generations will have the perspective granted by history with which to judge this time period with impartiality (and thereby with greater accuracy).

Several hundred years from now, historians of that coming era will look back with amazement as they analyze how the American civilization was ripped apart by the selfish desires of those who claimed to be acting in the best interests of society.

In closing, I think the rock group Rush expressed that sentiment quite well in their song "A Farewell to Kings":

A Farewell To Kings
When they turn the pages of history
When these days have passed long ago
Will they read of us with sadness
For the seeds that we let grow

We turned our gaze
From the castles in the distance
Eyes cast down
On the path of least resistance

Cities full of hatred, fear and lies
Withered hearts and cruel tormented eyes
Scheming demons dressed in kingly guise
Beating down the multitude
And scoffing at the wise

:-(

FTP and LDAP - Part 2: How to Set Up an Active Directory Lightweight Directory Services (AD LDS) Server

16 September 2011 • by Bob • FTP, Extensibility

This blog is designed as a complement to my FTP and LDAP - Part 1: How to Use Managed Code (C#) to Create an FTP Authentication Provider that uses an LDAP Server blog post. In this second blog, I'll walk you through the steps to set up an Active Directory Lightweight Directory Services (AD LDS) server, which you can use with the custom FTP LDAP Authentication provider that I discussed in my last blog.

In This Blog

Step 1: Installing AD LDS

The following steps will walk you through installing Active Directory Lightweight Directory Services on a computer that is running Windows Server 2008.

Adding the AD LDS Role

  1. Open the Windows Server 2008 Server Manager, click Roles in the navigation pane, and then click Add Roles.
  2. Check the box for Active Directory Lightweight Directory Services, and then click Next.
  3. Read the information on the Introduction to Active Directory Lightweight Directory Services page, and then click Next.
  4. Verify the Confirmation Installation Settings, and then click Next.
  5. The installation will start; this may take several minutes to complete.
  6. When the installation has completed, click Close.

Creating an AD LDS instance

Note: Before completing these steps I created a local user account named "LdapAdmin" that I would specify the administrative account for managing my LDAP instance. This user account was only a member of the local "Users" group, and not a member of the local "Administrators" group.

  1. Click Start, then click Administrative Tools, and then click Active Directory Lightweight Directory Services Setup Wizard.
  2. When the Active Directory Lightweight Directory Services Setup Wizard appears, click Next.
  3. Select A unique instance, and then click Next.
  4. Enter a name for your instance, for example "MyTestInstance," and then click Next.
  5. Verify the port numbers for LDAP connections, and then click Next.
  6. Choose Yes, create an application directory partition, and then enter a unique partition name by using X.500 path syntax. For example: "CN=MyServer,DC=MyDomain,DC=local". When you have finished entering your partition name, click Next.
  7. Verify the paths to the AD LDS files for this instance, and then click Next.
  8. Choose an account for your service account. (Note: Because I was creating a standalone LDAP server, I chose to use the network service account.) Once you have chosen an account, click Next.
  9. If you choose to use the network service account, the AD LDS wizard will prompt you about replication. Click Yes to continue.
  10. Choose an account as your AD LDS administrator. (Note: In my situation I chose the LdapAdmin account that I had created earlier; I did this so that I wouldn't be storing the credentials for an administrative account.) Once you have chosen an account, click Next.
  11. Choose one of the following LDIF files to import; these will be used to create user accounts.
    • MS-User.LDF
    • MS-InetOrgPerson.LDF
    Note: I tested my FTP LDAP authentication provider with both LDIF files.
  12. Verify your installation options, and then click Next.
  13. When prompted for your AD LDS credentials, enter the credentials for the account that you chose to administer your AD LDS instance.
  14. The wizard will begin to install the requisite files and create your instance; this may take several minutes to complete.

  15. When the wizard has completed, click Finish.

Step 2: Using ADSI Edit to add Users and Groups

Connecting to your AD LDS Server

  1. Click Start, and then Administrative Tools, and then ADSI Edit.
  2. Click Action, and then click Connect to...
  3. When the Connection Settingsdialog box is displayed:
    • Enter the LDAP path for your AD LDS server in the Select or type a Distinguished Name or Naming Contexttext box. For example:
      • CN=MyServer,DC=MyDomain,DC=local
    • Enter the server name and port in the Select or type a domain or servertext box. For example:
      • MYSERVER:389
    • The preceding steps should create the following path in the Pathtext box:
      • LDAP://MYSERVER:389/CN=MyServer,DC=MyDomain,DC=local
       
    • Click the Advanced button; when the Advanceddialog box is displayed:
      • Check the Specify Credentials box.
      • Enter the user name and password for your AD LDS server.
      • Click OK.
  4. Click OK.

Adding a User Object

  1. Expand the tree until you have highlighted the correct LDAP path for your server. For example:
    • CN=MyServer,DC=MyDomain,DC=local.
  2. Click Action, and then New, and then Object...
  3. Highlight the appropriate user class, and then click Next.
  4. Enter the common name for your user, and then click Next. For example: enter FtpUser for the common name.
  5. Click Finish.
  6. Right-click the user that you created, and then click Properties.
  7. Select msDS-UserAccountDisabled in the list of attributes, and then click Edit.
  8. Select False, and then click OK.
  9. Select userPrincipalName in the list of attributes, and then click Edit.
  10. Enter your user's common name for the value, and then click OK. For example: enter FtpUser for the common name.
  11. Click OK to close the user properties dialog box.
  12. Right-click the user that you created, and then click Reset Password...
  13. Enter and confirm the password for your user.
  14. Click OK.

Adding Users to Groups

  1. Retrieve the Distinguished Name (DN) for a user:
    • Right-click the user that you created, and then click Properties.
    • Select distinguishedName in the list of attributes, and then click View.
    • Copy the value, and then click OK. For example: CN=FtpUser,CN=MyServer,DC=MyDomain,DC=local.
    • Click OK to close the user's properties dialog box.
  2. Add the user to a group:
    • Expand the tree until you have highlighted a group in your server. For example, you could use the built-in CN-Users group.
    • Right-click the group, and then click Properties.
    • Select member in the list of attributes, and then click Edit.
    • When the editor dialog box is displayed, click Add DN...
    • When the Add Distinguished Name (DN) dialog box appears, paste the user DN syntax that you copied earlier. For example: CN=FtpUser,CN=MyServer,DC=MyDomain,DC=local.
    • Click OK to close the Add DN dialog box.
    • Click OK to close the group's properties dialog box.

More Information

For additional information about working with AD LDS instances, see the following URLs:

Enabling the Custom FTP LDAP Authentication Provider for an FTP site

While this is technically outside the scope of setting up the LDAP server, I'm reposting the notes from my last blog about adding the FTP LDAP Authentication provider and adding authorization rules for FTP users or groups.

  1. Add the custom authentication provider for an FTP site:
    • Open an FTP site in the Internet Information Services (IIS) Manager.
    • Double-click FTP Authentication in the main window.
    • Click Custom Providers... in the Actions pane.
    • Check FtpLdapAuthentication in the providers list.
    • Click OK.
  2. Add an authorization rule for the authentication provider:
    • Double-click FTP Authorization Rules in the main window.
    • Click Add Allow Rule... in the Actions pane.
    • You can add either of the following authorization rules:
      • For a specific user:
        • Select Specified users for the access option.
        • Enter a user name that you created in your AD LDS partition.
      • For a role or group:
        • Select Specified roles or user groups for the access option.
        • Enter the role or group name that you created in your AD LDS partition.
      • Select Read and/or Write for the Permissions option.
    • Click OK.

Once these settings are configured and users connect to your FTP site, the FTP service will attempt to authenticate users from your LDAP server by using the custom FTP LDAP Authentication provider.

Note: This blog was originally posted at http://blogs.msdn.com/robert_mcmurray/

FTP and LDAP - Part 1: How to Use Managed Code (C#) to Create an FTP Authentication Provider that uses an LDAP Server

16 September 2011 • by Bob • FTP, Extensibility

Over the past few years I've created a series of authentication providers for the FTP 7.5 service that ships with Windows Server 2008 R2 and Windows 7, and is available for download for Windows Server 2008. Some of these authentication providers are available on the http://learn.iis.net/page.aspx/590/developing-for-ftp-75/ website, while others have been in my blog posts.

With that in mind, I had a question a little while ago about using an LDAP server to authenticate users for the FTP service, and it seemed like that would make a great subject for another custom FTP authentication provider blog post.

The steps in this blog will lead you through the steps to use managed code to create an FTP authentication provider that uses a server running Active Directory Lightweight Directory Services (AD LDS) that is located on your local network.

Note: I wrote and tested the steps in this blog using both Visual Studio 2010 and Visual Studio 2008; if you use an different version of Visual Studio, some of the version-specific steps may need to be changed.

In This Blog

Prerequisites

The following items are required to complete the procedures in this blog:

  1. The following version of IIS must be installed on your Windows computer, and the Internet Information Services (IIS) Manager must also be installed:
    • IIS 7.0 must be installed on Windows Server 2008
    • IIS 7.5 must be installed on Windows Server 2008 R2 or Windows 7
  2. The new FTP 7.5 service must be installed. To install FTP 7.5, follow the instructions in the following topic:
  3. You must have FTP publishing enabled for a site. To create a new FTP site, follow the instructions in the following topic:
  4. You must have an AD LDS server available on your local network. Note: See my How to Set Up an Active Directory Lightweight Directory Services (AD LDS) Server blog post for more information.

Note: To test this blog, I used AD LDS on Windows Server 2008; if you use a different LDAP server, you may need to change some of the LDAP syntax in the code samples. To get started using AD LDS, see the following topics:

I tested this blog by using the user objects from both the MS-User.LDF and MS-InetOrgPerson.LDF Lightweight Directory interchange Format (LDIF) files.

Important

To help improve the performance for authentication requests, the FTP service caches the credentials for successful logins for 15 minutes by default. This means that if you change the password in your AD LDS server, this change may not be reflected for the cache duration. To alleviate this, you can disable credential caching for the FTP service. To do so, use the following steps:

  1. Open a command prompt.
  2. Type the following commands: 
    cd /d "%SystemRoot%\System32\Inetsrv"
Appcmd.exe set config -section:system.ftpServer/caching /credentialsCache.enabled:"False" /commit:apphost
Net stop FTPSVC
Net start FTPSVC
  3. Close the command prompt.

Step 1: Set up the Project Environment

In this step, you will create a project in Visual Studio 2008 for the demo provider.

  1. Open Microsoft Visual Studio 2008.
  2. Click the File menu, then New, then Project.
  3. In the New Projectdialog box:
    • Choose Visual C# as the project type.
    • Choose Class Library as the template.
    • Type FtpLdapAuthentication as the name of the project.
    • Click OK.
  4. When the project opens, add a reference path to the FTP extensibility library:
    • Click Project, and then click FtpLdapAuthentication Properties.
    • Click the Reference Paths tab.
    • Enter the path to the FTP extensibility assembly for your version of Windows, where C: is your operating system drive.
      • For Windows Server 2008 and Windows Vista:
        • C:\Windows\assembly\GAC_MSIL\Microsoft.Web.FtpServer\7.5.0.0__31bf3856ad364e35
      • For 32-bit Windows 7 and Windows Server 2008 R2:
        • C:\Program Files\Reference Assemblies\Microsoft\IIS
      • For 64-bit Windows 7 and Windows Server 2008 R2:
        • C:\Program Files (x86)\Reference Assemblies\Microsoft\IIS
    • Click Add Folder.
  5. Add a strong name key to the project:
    • Click Project, and then click FtpLdapAuthentication Properties.
    • Click the Signing tab.
    • Check the Sign the assembly check box.
    • Choose <New...> from the strong key name drop-down box.
    • Enter FtpLdapAuthenticationKey for the key file name.
    • If desired, enter a password for the key file; otherwise, clear the Protect my key file with a password check box.
    • Click OK.
  6. Note: FTP 7.5 Extensibility does not support the .NET Framework 4.0; if you are using Visual Studio 2010, or you have changed your default framework version, you may need to change the framework version. To do so, use the following steps:
    • Click Project, and then click FtpLdapAuthentication Properties.
    • Click the Application tab.
    • Choose .NET Framework 3.5 in the Target framework drop-down menu.
    • Save, close, and re-open the project.
  7. Optional: You can add a custom build event to add the DLL automatically to the Global Assembly Cache (GAC) on your development computer:
    • Click Project, and then click FtpLdapAuthentication Properties.
    • Click the Build Events tab.
    • Enter the appropriate commands in the Post-build event command linedialog box, depending on your version of Visual Studio:
      • If you are using Visual Studio 2010:
        net stop ftpsvc
        call "%VS100COMNTOOLS%\vsvars32.bat">null
        gacutil.exe /if "$(TargetPath)"
        net start ftpsvc
      • If you are using Visual Studio 2008:
        net stop ftpsvc
        call "%VS90COMNTOOLS%\vsvars32.bat">null
        gacutil.exe /if "$(TargetPath)"
        net start ftpsvc
      Note: You need to be logged in as an administrator in order to restart the service and add the dll to the Global Assembly Cache.
  8. Save the project.

Step 2: Create the Extensibility Class

In this step, you will implement the authentication and role extensibility interfaces for the demo provider.

  1. Add the necessary references to the project:
    • Click Project, and then click Add Reference...
    • On the .NET tab, click Microsoft.Web.FtpServer.
    • Click OK.
    • Repeat the above steps to add the following references to the project:
      • System.Configuration
      • System.DirectoryServices
      • System.DirectoryServices.AccountManagement
  2. Add the code for the authentication class:
    • In Solution Explorer, double-click the Class1.cs file.
    • Remove the existing code.
    • Paste the following code into the editor: 
      using System;
using System.Collections.Specialized;
using System.Configuration.Provider;
using System.DirectoryServices;
using System.DirectoryServices.AccountManagement;
using Microsoft.Web.FtpServer;

public class FtpLdapAuthentication :
  BaseProvider,
  IFtpAuthenticationProvider,
  IFtpRoleProvider
{
  private static string _ldapServer = string.Empty;
  private static string _ldapPartition = string.Empty;
  private static string _ldapAdminUsername = string.Empty;
  private static string _ldapAdminPassword = string.Empty;

  // Override the default initialization method.
  protected override void Initialize(StringDictionary config)
  {
    // Retrieve the provider settings from configuration.
    _ldapServer = config["ldapServer"];
    _ldapPartition = config["ldapPartition"];
    _ldapAdminUsername = config["ldapAdminUsername"];
    _ldapAdminPassword = config["ldapAdminPassword"];

    // Test for the LDAP server name (Required).
    if (string.IsNullOrEmpty(_ldapServer) || string.IsNullOrEmpty(_ldapPartition))
    {
      throw new ArgumentException(
        "Missing LDAP server values in configuration.");
    }
  }

  public bool AuthenticateUser(
    string sessionId,
    string siteName,
    string userName,
    string userPassword,
    out string canonicalUserName)
  {
    canonicalUserName = userName;
    // Attempt to look up the user and password.
    return LookupUser(true, userName, string.Empty, userPassword);
  }

  public bool IsUserInRole(
    string sessionId,
    string siteName,
    string userName,
    string userRole)
  {
    // Attempt to look up the user and role.
    return LookupUser(false, userName, userRole, string.Empty);
  }

  private static bool LookupUser(
    bool isUserLookup,
    string userName,
    string userRole,
    string userPassword)
  {
    PrincipalContext _ldapPrincipalContext = null;
    DirectoryEntry _ldapDirectoryEntry = null;

    try
    {
      // Create the context object using the LDAP connection information.
      _ldapPrincipalContext = new PrincipalContext(
        ContextType.ApplicationDirectory,
        _ldapServer,

        _ldapPartition,
        ContextOptions.SimpleBind,
        _ldapAdminUsername,
        _ldapAdminPassword);

      // Test for LDAP credentials.
      if (string.IsNullOrEmpty(_ldapAdminUsername) || string.IsNullOrEmpty(_ldapAdminPassword))
      {
        // If LDAP credentials do not exist, attempt to create an unauthenticated directory entry object.
        _ldapDirectoryEntry = new DirectoryEntry("LDAP://" + _ldapServer + "/" + _ldapPartition);
      }
      else
      {
        // If LDAP credentials exist, attempt to create an authenticated directory entry object.
        _ldapDirectoryEntry = new DirectoryEntry("LDAP://" + _ldapServer + "/" + _ldapPartition,
          _ldapAdminUsername, _ldapAdminPassword, AuthenticationTypes.Secure);
      }

      // Create a DirectorySearcher object from the cached DirectoryEntry object.
      DirectorySearcher userSearcher = new DirectorySearcher(_ldapDirectoryEntry);
      // Specify the the directory searcher to filter by the user name.
      userSearcher.Filter = String.Format("(&(objectClass=user)(cn={0}))", userName);
      // Specify the search scope.
      userSearcher.SearchScope = SearchScope.Subtree;
      // Specify the directory properties to load.
      userSearcher.PropertiesToLoad.Add("distinguishedName");
      // Specify the search timeout.
      userSearcher.ServerTimeLimit = new TimeSpan(0, 1, 0);
      // Retrieve a single search result.
      SearchResult userResult = userSearcher.FindOne();
      // Test if no result was found.
      if (userResult == null)
      {
        // Return false if no matching user was found.
        return false;
      }
      else
      {
        if (isUserLookup == true)
        {
          try
          {
            // Attempt to validate credentials using the username and password.
            return _ldapPrincipalContext.ValidateCredentials(userName, userPassword, ContextOptions.SimpleBind);
          }
          catch (Exception ex)
          {
            // Throw an exception if an error occurs.
            throw new ProviderException(ex.Message);
          }
        }
        else
        {
          // Retrieve the distinguishedName for the user account.
          string distinguishedName = userResult.Properties["distinguishedName"][0].ToString();

          // Create a DirectorySearcher object from the cached DirectoryEntry object.
          DirectorySearcher groupSearcher = new DirectorySearcher(_ldapDirectoryEntry);
          // Specify the the directory searcher to filter by the group/role name.
          groupSearcher.Filter = String.Format("(&(objectClass=group)(cn={0}))", userRole);
          // Specify the search scope.
          groupSearcher.SearchScope = SearchScope.Subtree;
          // Specify the directory properties to load.
          groupSearcher.PropertiesToLoad.Add("member");
          // Specify the search timeout.
          groupSearcher.ServerTimeLimit = new TimeSpan(0, 1, 0);
          // Retrieve a single search result.
          SearchResult groupResult = groupSearcher.FindOne();

          // Loop through the member collection.
          for (int i = 0; i < groupResult.Properties["member"].Count; ++i)
          {
            string member = groupResult.Properties["member"][i].ToString();
            // Test if the current member contains the user's distinguished name.
            if (member.IndexOf(distinguishedName, StringComparison.OrdinalIgnoreCase) > -1)
            {
              // Return true (role lookup succeeded) if the user is found.
              return true;
            }
          }
          // Return false (role lookup failed) if the user is not found for the role.
          return false;
        }
      }
    }
    catch (Exception ex)
    {
      // Throw an exception if an error occurs.
      throw new ProviderException(ex.Message);
    }
  }
}
  3. Save and compile the project.

Note: If you did not use the optional steps to register the assemblies in the GAC, you will need to manually copy the assemblies to your IIS 7 computer and add the assemblies to the GAC using the Gacutil.exe tool. For more information, see the following topic on the Microsoft MSDN Web site:

Global Assembly Cache Tool (Gacutil.exe)

Step 3: Add the Demo Provider to FTP

In this step, you will add your provider to the list of providers for your FTP service, configure your provider for your LDAP server, and enable your provider to authenticate users for an FTP site.

Adding your Provider to FTP

  1. Determine the assembly information for your extensibility provider:
    • In Windows Explorer, open your "C:\Windows\assembly" path, where C: is your operating system drive.
    • Locate the FtpLdapAuthentication assembly.
    • Right-click the assembly, and then click Properties.
    • Copy the Culture value; for example: Neutral.
    • Copy the Version number; for example: 1.0.0.0.
    • Copy the Public Key Token value; for example: 426f62526f636b73.
    • Click Cancel.
  2. Add the extensibility provider to the global list of FTP authentication providers:
    • Open the Internet Information Services (IIS) Manager.
    • Click your computer name in the Connections pane.
    • Double-click FTP Authentication in the main window.
    • Click Custom Providers... in the Actions pane.
    • Click Register.
    • Enter FtpLdapAuthentication for the provider Name.
    • Click Managed Provider (.NET).
    • Enter the assembly information for the extensibility provider using the information that you copied earlier. For example:
      FtpLdapAuthentication,FtpLdapAuthentication,version=1.0.0.0,Culture=neutral,PublicKeyToken=426f62526f636b73
    • Click OK.
    • Clear the FtpLdapAuthentication check box in the providers list.
    • Click OK.

Configuring your Provider's Settings

  1. Determine the connection information for your LDAP server; there are four pieces of information that you will need to know in order to configure the extensibility provider to talk to your LDAP server:
    • Server Name and TCP/IP Port: This is the name (or IP address) of the server that is hosting your LDAP service; the port is usually 389. These will be added to your provider using the "SERVERNAME:PORT" syntax.
    • LDAP Partition: This is the LDAP path within your LDAP service to your data, for example: "CN=ServerName,DC=DomainName,DC=DomainExtension."
    • LDAP Username: This is a username that has access to your LDAP server; this is not the name of an account that you will use for FTP access, and it does not have to be a Windows account.
    • LDAP Password: This is the password that is associated with the LDAP username.
  2. Using the information from the previous steps, configure the options for the provider:
    • At the moment there is no user interface that enables you to add properties for a custom authentication module, so you will have to use the following command line. You will need to update the highlighted areas with the information from the previous steps and the information for your LDAP server:
      cd %SystemRoot%\System32\Inetsrv

      appcmd.exe set config -section:system.ftpServer/providerDefinitions /+"activation.[name='FtpLdapAuthentication']" /commit:apphost

      appcmd.exe set config -section:system.ftpServer/providerDefinitions /+"activation.[name='FtpLdapAuthentication'].[key='ldapServer',value='MYSERVER:389']" /commit:apphost

      appcmd.exe set config -section:system.ftpServer/providerDefinitions /+"activation.[name='FtpLdapAuthentication'].[key='ldapPartition',value='CN=MyServer,DC=MyDomain,DC=local']" /commit:apphost

      appcmd.exe set config -section:system.ftpServer/providerDefinitions /+"activation.[name='FtpLdapAuthentication'].[key='ldapAdminUsername',encryptedValue='MyAdmin']" /commit:apphost

      appcmd.exe set config -section:system.ftpServer/providerDefinitions /+"activation.[name='FtpLdapAuthentication'].[key='ldapAdminPassword',encryptedValue='MyPassword1']" /commit:apphost
    • Note: The highlighted areas are the values for the ldapServer, ldapPartition, ldapAdminUsername, and ldapAdminPassword settings, which configure your network environment for your LDAP server.

Enabling your Provider for an FTP site

  1. Add the custom authentication provider for an FTP site:
    • Open an FTP site in the Internet Information Services (IIS) Manager.
    • Double-click FTP Authentication in the main window.
    • Click Custom Providers... in the Actions pane.
    • Check FtpLdapAuthentication in the providers list.
    • Click OK.
  2. Add an authorization rule for the authentication provider:
    • Double-click FTP Authorization Rules in the main window.
    • Click Add Allow Rule... in the Actions pane.
    • You can add either of the following authorization rules:
      • For a specific user:
        • Select Specified users for the access option.
        • Enter a user name that you created in your AD LDS partition.
      • For a role or group:
        • Select Specified roles or user groups for the access option.
        • Enter the role or group name that you created in your AD LDS partition.
      • Select Read and/or Write for the Permissions option.
    • Click OK.

Summary

In this blog I showed you how to:

  • Create a project in Visual Studio 2010 or Visual Studio 2008 for a custom FTP authentication provider.
  • Implement the extensibility interface for custom FTP authentication.
  • Add a custom authentication provider to your FTP service.

When users connect to your FTP site, the FTP service will attempt to authenticate users from your LDAP server by using your custom authentication provider.

Additional Information

The PrincipalContext.ValidateCredentials() method will validate the user name in the userName parameter with the value of the userPrincipalName attribute of the user object in AD LDS. Because of this, the userPrincipalName attribute for a user object is expected to match the name of the user account that an FTP client will use to log in, which will should be the same value as the cn attribute for the user object. Therefore, when you create a user object in AD LDS, you will need to set the corresponding userPrincipalName attribute for the user object. In addition, when you create a user object in AD LDS, the msDS-UserAccountDisabled attribute is set to TRUE by default, so you will need to change the value of that attribute to FALSE before you attempt to log in.

For more information, see my follow-up blog that is titled FTP and LDAP - Part 2: How to Set Up an Active Directory Lightweight Directory Services (AD LDS) Server.

Note: This blog was originally posted at http://blogs.msdn.com/robert_mcmurray/

The Days Grow Shorter...

15 September 2011 • by Bob • Ponderings

Back in the 1980s I was a big fan of the Canadian Power Trio named "Triumph." As far as arena rock was concerned, few bands could put on a show that was anywhere near as entertaining as a Triumph concert. It wasn't just about being a fan - there are any number of great bands out there who could put on a good show if you already liked them; but Triumph put on a killer show whether you liked them or not.

At the height of their popularity, Triumph recorded what was to become one of their greatest hits, which was a song that was titled "Fight the Good Fight." Many guitar players - myself included - spent a good deal of time learning that song, and I always enjoyed playing it live in the various rock bands that I played in throughout my teenage years.

As the first official day of Autumn is just around the corner here in Seattle, the opening lines to "Fight the Good Fight" seem to take on special meaning:

"The days grow shorter,
And the nights are getting long.
Feels like we're running out of time."

As I look out of my office window, that's exactly what I see:

Our short-lived Pacific Northwest Summer appears to have come to a close, and the clouds seem like they're here for the duration. The sun is setting a little earlier each day, and within a few months the choleric combination of miserable mists and depressing dusk will shorten the average day to six hours or less of daylight. And yet the most discouraging fact that I have to wrestle with today is the knowledge that the weather will be this way for the next nine months.

[I exhale a deep sigh...] Storm cloud

Three months from now is the Winter Solstice, at which time we will confront the shortest day of the year; after that, we will at least have the small consolation that each day will be a little longer than the last, but we still won't see much of the sun until sometime next June or July.

[I heave another deep sigh...] Storm cloud

I wonder how much a plane ticket to Hawaii would cost in January? Island with a palm tree

Sometimes I Make My Day...

08 September 2011 • by Bob • Scripting

This past weekend I was writing a quick piece of Windows Script Host (WSH) code to clean up some files on one of my servers, and I had populated a Scripting.Dictionary object with a bunch of string data that I was going to write to a log file. Obviously it's much easier to read through the log file if the data is sorted, but the Scripting.Dictionary object does not have a built-in Sort() method.

With this in mind, I set out to write a sorting function for my script, when I decided that it would might be more efficient to see if someone out in the community had already written such a function. I quickly discovered that someone had - and it turns out, that particular someone was me!

Way back in 1999 I published Microsoft Knowledge Base (KB) article 246067, which was titled "Sorting a Scripting Dictionary Populated with String Data." This KB article contained the following code, which took care of everything for me:

Const dictKey  = 1
Const dictItem = 2

Function SortDictionary(objDict,intSort)
  ' declare our variables
  Dim strDict()
  Dim objKey
  Dim strKey,strItem
  Dim X,Y,Z

  ' get the dictionary count
  Z = objDict.Count

  ' we need more than one item to warrant sorting
  If Z > 1 Then
    ' create an array to store dictionary information
    ReDim strDict(Z,2)
    X = 0
    ' populate the string array
    For Each objKey In objDict
        strDict(X,dictKey)  = CStr(objKey)
        strDict(X,dictItem) = CStr(objDict(objKey))
        X = X + 1
    Next

    ' perform a a shell sort of the string array
    For X = 0 to (Z - 2)
      For Y = X to (Z - 1)
        If StrComp(strDict(X,intSort),strDict(Y,intSort),vbTextCompare) > 0 Then
            strKey  = strDict(X,dictKey)
            strItem = strDict(X,dictItem)
            strDict(X,dictKey)  = strDict(Y,dictKey)
            strDict(X,dictItem) = strDict(Y,dictItem)
            strDict(Y,dictKey)  = strKey
            strDict(Y,dictItem) = strItem
        End If
      Next
    Next

    ' erase the contents of the dictionary object
    objDict.RemoveAll

    ' repopulate the dictionary with the sorted information
    For X = 0 to (Z - 1)
      objDict.Add strDict(X,dictKey), strDict(X,dictItem)
    Next

  End If

End Function

Sometimes I make my day. ;-]

I Must Have Grown Up at Some Point, but I Don't Remember When

22 August 2011 • by Bob • Ponderings

My middle daughter turned 24 last week. This was a significant occasion by itself, but it was made even more significant because I had just walked her down the aisle only three weeks earlier when she married a great guy from Vancouver, BC.

It seems like only yesterday that I was teaching her how to brush her teeth, how to ride a bicycle, and how to write an English paper that didn't sound like she was talking to one of her friends on the telephone.

Momentous events like these will often motivate you sit back and wonder where the time went. It's been nearly thirty years since I became a "legal adult," but I still don't feel like I'm a "grown up." I still want to believe that my dad is the grown-up and I am just some long-haired kid from Arizona.

But it's easy for me to do the math - in a few short years my oldest daughter will turn thirty, so I must have grown up at some point; I just can't remember when.

Smile

IIS 6: Setting up SSL - Appendix C: Processing a Certificate Request using Windows 2003 Certificate Services

03 August 2011 • by Bob • IIS, SSL

In this last appendix for my blog series about using SSL with IIS 6, I'll discuss processing a certificate request by using Windows 2003 Certificate Services. When you are running a certificate server for your network environment, you will need to physically issue the certificates that clients will request from your certificate server. There is a way that you can configure certificate services to automatically issue certificates, but I'd advise against that, unless you are only issuing certificates for testing purposes. If so, then you should read the Set the default action upon receipt of a certificate request topic on Microsoft's TechNet website.

That being said, the procedure to approve and issue a certificate is relatively easy; to do so, use the following steps:

  1. Open the "Certificate Authority" administrative tool:

  2. Click on "Pending Requests":

  3. Right-click the pending request and choose "All Tasks", then click "Issue":

  4. The certificate will now show up under "Issued Certificates":

That wraps up the last post in this blog series about using Secure Sockets Layer (SSL) with IIS 6.0, as well as some related information about using Windows 2003 Certificate Services. I hope this information helps administrators that have yet to upgrade to Windows Server 2008 or Windows Server 2008 R2. ;-]

Note: This blog was originally posted at http://blogs.msdn.com/robert_mcmurray/

Blog Navigation

You are on page 58 of 72 pages.

Tag Cloud

Disclaimer

All content within this blog represents my personal views and opinions only. This content is not intended to represent the views, positions, or strategies of my employer or any other organization with which I may be associated. All content and code samples are provided "as is" without warranty of any kind.