Set up an FTP site on Windows

Step 1: Add Web Server and FTP Server roles

Before you create an FTP site, ensure the Web Server (IIS) and FTP Server roles are installed on your instance. If not, follow these steps to add them.

1. Establish a remote connection to the Windows instance.

   For more information, see Connect to a Windows instance by using Workbench.

2. On the Windows desktop, click the Start icon in the lower-left corner, and then click Server Manager.

3. In the top navigation bar, choose Manage > Add Roles and Features.

   

4. In the Before You Begin wizard, click Next.

5. Select Role-based or feature-based installation and click Next.

   

6. Select Select a server from the server pool, choose the server where you want to deploy the FTP site, and then click Next.

   

7. Select Web Server (IIS). In the dialog box that appears, click Add Features, and then click Next.

   

   

8. Keep the default settings and click Next until you reach the Select role services page.

9. Select IIS Management Console and FTP Server, and then click Next.

   

10. Click Install. After the installation is complete, click Close.

(Optional) Step 2: Create a Windows user for FTP

Create a Windows user for authentication to the FTP site. If you only need to allow anonymous access to the FTP site (where users log on with the username anonymous or ftp), you can skip this step.

1. In Server Manager, go to Tools > Computer Management.

   

2. In the navigation pane on the left, go to System tools > Local Users and Groups > User. Right-click a blank area in the main pane and select New User.

   

3. In the New User dialog box, set the User Name and Password.

   The following list describes the parameters.

   • Username: This example creates a Windows user named ftptest.

   • Password and Confirm password: Enter a custom password.

     Note

     The password must contain uppercase letters, lowercase letters, and digits to meet the password policy. Keep your password secure to prevent security risks.

   • Password settings: Select Password never expires.

4. Click Create, and then close the New User dialog box.

Step 3: Set permissions for the shared folder

Create a folder to serve as the shared directory for your FTP site and grant it appropriate permissions for access and modification.

1. On your Windows instance, create a folder for the FTP site.

   In this example, a folder named ftp is created on the C: drive.

2. Right-click the ftp folder and select Properties.

3. Click the Security tab, select Everyone, and then click Edit.

   If the Everyone user is not listed, you must add it. For more information, see What do I do if the Everyone option is not available when I set folder permissions?.

   

4. In the dialog box, select Everyone. In the Permissions for Everyone section, select the required permissions, and then click OK.

   In this example, all permissions are granted.

   

Step 4: Add and configure the FTP site

1. On the Windows desktop, click the Start icon in the lower-left corner, and then click Server Manager.

2. In the top navigation bar, go to Tools > Internet Information Services (IIS) Manager.

   

3. In the left navigation bar, select Windows Instance Hostname > Website, and then click Add FTP Site in the Operation column on the right.

   

4. In the Site Information dialog box, configure the site details and click Next.

   The following list describes the parameters.

   • FTP Site Name: A custom name, such as ftptest.

   • Content Directory: Select the ftp folder that you created on the C: drive.

5. Configure the IP address and SSL settings, and then click Next.

   The following list describes the parameters.

   • IP Address: Keep the default setting.

   • SSL: The following describes the options for this setting. In this example, No SSL (L) is selected, which means SSL encryption is not required. If you need to ensure data transmission security and have an SSL certificate, set this parameter to Allow SSL (W) or Require SSL (R) based on your actual data transmission security requirements.

     • No SSL (L): SSL encryption is not required.

     • Allow SSL(W): Allows the FTP Server to support both non-SSL and SSL connections with clients.

     • SSL Required: Requires SSL encryption for communication between the FTP server and the client.

   • Keep the default settings for other parameters.

     Note

     If SSL is set to Allow or Yes, you must select an SSL certificate. You can select an existing SSL certificate or create a new one. For more information about how to create a server certificate, see How do I create a server certificate?.

6. Set the authentication and authorization information, and then click Finish.

   The following list describes the parameters.

   • Authentication: In this example, only Basic (B) is selected. You will then use the ftptest user that you created to access the FTP site. If you do not have security requirements for data transfer, you can select Anonymous (A), which allows anonymous users to directly access the FTP site.

     • Anonymous (A): Allows any user who provides the username anonymous or ftp to access the content.

     • Basic (B): Requires users to provide a valid username and password to access content. Because Basic authentication transmits unencrypted passwords over the network, use this authentication method only when the connection between the client and the FTP Server is secure, such as by using Secure Sockets Layer (SSL).

   • Authorization: To specify the access scope, select Specified users in this example and enter ftptest in the corresponding text box.

     • All Users: All users, whether anonymous or authenticated, can access the shared folder associated with the FTP site.

     • Anonymous user: An anonymous user can access the shared folder of the FTP site.

     • Specify roles or user groups: Only members of specific roles or user groups can access the shared folder that corresponds to the FTP site. You must enter the roles or user groups in the corresponding text box.

     • Specified users: Only specified users can access the shared folder for the FTP site. You must enter the usernames in the corresponding text box.

   • Permissions: Select Read and Write.

   The newly created FTP site now appears in the Internet Information Services (IIS) Manager.

7. Configure the FTP site firewall.

   1. In IIS Manager, double-click the FTP site name ftptest to go to its home page.

   2. Double-click FTP Firewall Support to open the configuration page.

      

   3. Configure the following parameters and click Application.

      • Data Channel Port Range: Specify the port range for passive connections. The valid range is 1025-65535. Set this range based on your requirements.

      • External IP Address of Firewall: Enter the public IP address of the ECS instance.

      

      Note

      For information about why you need to allow a port range for FTP passive mode and for configuration recommendations, see Port configuration recommendations for FTP passive mode.

   4. Open the Command Prompt on your Windows instance and run the following commands to restart the FTP service:

      net stop ftpsvc 
       
      net start ftpsvc  

Step 5: Configure the security group and firewall

After you set up the FTP site on your Windows instance, you must add inbound rules to the security group of the instance to allow traffic on port 21 and the data channel port range that you configured for passive mode.

1. In the security group of the Windows instance, add inbound rules to allow traffic on port 21 and the port range 40000–40100.

   For more information, see Add a security group rule.

   

   Note

   For more information about security groups, see Security group overview and use cases and Common ports.

2. (Optional) Configure the internal firewall of the Windows instance.

   By default, the internal firewall of a Windows instance is disabled. If the firewall is enabled, you must allow traffic on TCP port 21 and the port range 40000–40100 for the FTP service.

   For more information, see Configure the firewall for remote connections to an ECS instance.

   For other firewall settings, see Microsoft's official documentation.

Step 6: Test the FTP site

You can test the FTP site by using various tools, such as Windows File Explorer, a web browser, or a third-party FTP client. This example uses File Explorer on a local Windows machine.

1. On your local Windows client, open File Explorer, and in the address bar, enter ftp://<the public IP address of the FTP site>:21 to connect.

   The following figure shows an example in Windows 10.

2. In the Log On As dialog box, enter the logon credentials, and then click Log On.

   In this example, use the username ftptest and the corresponding password to log on to the FTP site.When you access the FTP site from Windows File Explorer, if the Use Passive FTP option is not enabled in the built-in Internet Explorer (IE) in Windows, you cannot properly access the FTP site, and error codes 200 and 501 are returned. You can follow the steps below to enable the Use Passive FTP option in IE and then try to access the FTP site again.

   1. On your local Windows client, open Internet Explorer.

   2. In the upper-right corner, click the Tools icon and select Internet options.

   3. Click the Premium tab, and in the settings area, select Use passive FTP (for firewall and DSL modem compatibility).

   4. Click Application, and then click OK.

   After you successfully access the ftp shared folder for the FTP site, you can create a test folder named test.You can then log on to the Windows instance again to verify that the test folder is added to the ftp folder on the C drive. This indicates that the FTP site is set up successfully and can be used for file transfers.