You can build an FTP site on an Elastic Compute Service (ECS) Windows instance so
that you can transfer files to or from the instance after you connect to it. This
topic describes how to build an FTP site on a Windows instance. This topic is applicable
to Windows Server 2008 or later. In the examples, Windows Server 2016 is used.
Prerequisites
One or more Windows instances are created. In the examples, a Windows instance that
has the following configurations is used:
- Instance type: ecs.c6.large
- Operating system: Windows Server 2016 64-bit
Step 1: Add Internet Information Services (IIS) and FTP server roles
You must install the IIS and FTP services before you can build an FTP site. If you
have not installed the IIS and FTP services, perform the following steps to install
the services.
- Connect to the Windows instance.
- In the left-lower corner of the Windows desktop, click the Start (
) icon. Then, find and click Server Manager.
- In the top navigation bar, choose .
- In the dialog box that appears, accept the default settings and click Next until you reach the Select server roles step.
- Select Web Server (IIS). In the dialog box that appears, click Add Features and then click Next.
- Accept the default settings and click Next until you reach the Select role services step.
- Select IIS Management Console and FTP Server and click Next.
- Click Install. After the IIS and FTP server roles are added, click Close.
Step 2: Create a Windows user to access the FTP site
Create a Windows user to access the FTP site to be built. If you want to access the
FTP site as an anonymous user with the anonymous
or ftp
username, skip the steps described in this section.
- In the left-lower corner of the Windows desktop, click the Start (
) icon. Then, find and click Windows Administrative Tools.
- In the Administrative Tools window, find and double-click Computer Management.
- In the left-side navigation pane, choose .
- In the Actions column in the right part of the window, click More Actions and then click New User...

Configure the following parameters or settings:
- User name: In this example, the
ftptest
username is used.
- Password and Confirm password: Enter a password.
Note The password must contain uppercase letters, lowercase letters, and digits. Keep your
password information confidential to prevent data security risks caused by password
leaks.
- Password-related settings: Select Password never expires.
- Click Create and close the New User dialog box.
Step 3: Configure permissions for sharing files
You must create a folder for sharing files with the FTP site and grant the access
and modification permissions on the folder. Subsequently, when clients access the
FTP site, all files are transferred by using this folder. Perform the following operations:
- On a disk of the Windows instance, create a folder for the FTP site to use.
In this example, a folder named ftp is created on Disk C.
- Right-click the ftp folder and click Properties.
- Click the Security tab and then click Edit.
- Click Create.
- In the dialog box that appears, enter ftptest as the object name and click Check Name.
- Confirm that the entered object name is correct and click OK.
- In the Group or user names section, click the ftptest username, configure permissions in the Permissions for ftptest section, and then click OK.
In this example, all permissions in the Allow column are selected. You can select
or clear permissions in the Allow or Deny column based on your business requirements.

Step 4: Create and configure an FTP site
- In the left-lower corner of the Windows desktop, click the Start (
) icon. Then, find and click Server Manager.
- In the top navigation bar, choose .
- In the left-side navigation pane, choose . Then, in the Actions column in the right part, click Add FTP Site...
- In the dialog box that appears, configure parameters and click Next.

Configure the following parameters:
- FTP site name: Enter a name for the FTP site. Example:
ftptest
.
- Content Directory: Specify the path to the shared folder required by FTP. In this
example, the shared folder is the ftp folder created on Disk C.
- Configure the IP address and SSL settings and click Next.

Configure the following parameters:
- IP Address: Accept the default settings.
- SSL: In this example, No SSL is selected, which indicates that SSL encryption is not required. If you want to
secure data transfers and already have an SSL certificate, select Allow SSL or Require SSL.
- No SSL: SSL encryption is not required.
- Allow SSL: The FTP server is allowed to support both non-SSL and SSL connections with a client.
- Require SSL: SSL encryption is required for communication between the FTP server and a client.
- Accept the default settings for other parameters.
- Configure authentication and authorization information and click Finish.

Configure the following parameters:
- Authentication: In this example, only Basic is selected. Then, you can use the
ftptest
user that you created to access the FTP site. If you do not have security requirements
on data transfers, you can select Anonymous so that you can access the FTP site as an anonymous user.
- Anonymous: allows users that provides the
anonymous
or ftp
username to access content.
- Basic: requires users to provide valid usernames and passwords to access content. Basic
authentication transmits unencrypted passwords across the network. We recommend that
you use basic authentication only when you are certain that the connection between
the client and the FTP server is secure, such as when SSL encryption is used.
- Authorization: In this example, Allow access to is set to Specified users, and ftptest is entered.
- All users: All users are allowed to access the shared folder corresponding to the FTP site.
- Anonymous users: Anonymous users can access the shared folder corresponding to the FTP site.
- Specified roles or user groups: Only specified roles or members of specified groups can access the shared folder
corresponding to the FTP site. Enter roles or groups in the corresponding field.
- Specified users: Only specified users can access the shared folder corresponding to the FTP site.
Enter usernames in the corresponding field. In this example, ftptest is entered.
- Permissions: Select both Read and Write.
After the preceding steps are performed, you can view the built FTP site in Internet
Information Services (IIS) Manager.

- Configure the firewall of the FTP site.
- In the Internet Information Services (IIS) Manager window, double-click the FTP site
name
ftptest
to go to the ftptest Home page.
- Double-click FTP Firewall Support.
- In the External IP Address of Firewall field, enter <Public IP address of the Windows instance>.
- In the Actions column on the right, click Apply. In the message that appears, click OK.
Step 5: Configure security groups and the firewall
After you build the FTP site on the Windows instance, you must add inbound rules to
the security groups of the instance to allow traffic to port 21 and the passive port
range of 1024 to 65535 of the FTP server.
Note Specify the port range based on your needs. We recommend that you use ports with higher
numbers. In this example, the port range of 29000 to 30000 is used.
- In the security groups of the Windows instance, add inbound rules to allow traffic
to port 21 and ports in the range of 29000 to 30000.
- Optional:Configure the firewall of the Windows instance.
By default, the firewall of the Windows instance is disabled. If your firewall is
enabled, allow traffic on TCP port 21 and ports in the range of 29000 to 30000 for
the FTP service.
For more information about firewall settings, see Build an FTP Site on IIS.
Step 6: Use a client to test access to the FTP site
Windows File Explorer, command-line tools, browsers, or third-party FTP connection
tools can be used to test the FTP server. In this example, a Windows computer is used
as an FTP client and Windows File Explorer is used to access the FTP site.
- On the Windows computer, open Windows File Explorer and enter
ftp://<Public IP address of the FTP site>:21
in the address bar. In this example, Window 10 is used.

- In the Log On As dialog box, configure logon credentials and click OK.
In this example, the
ftptest
username and its corresponding password are used as credentials to log on to the
FTP site.

When you use Windows File Explorer to access the FTP site, if
Use Passive FTP is not enabled for the IE browser on Windows, you cannot access the FTP site. The
error codes
200 and
501 are returned. You can perform the following steps to enable
Use Passive FTP for the IE browser and then access the FTP site again.
- In the Windows computer, open the IE browser.
- In the upper-right corner, click the Tools (
) icon and select Internet Properties.
- Click the Advanced tab. In the Settings section, find and select Use Passive FTP (for firewall and DSL modem compatibility).

- Click Apply and then click OK.
After you access the shared
ftp folder that corresponds to the FTP site, you can create a test folder named
test.

Then, you can log on to the Windows instance again. If the FTP site is built and can
be used for data transfers, you can find the
test folder in the
ftp folder on Disk C.

What to do next
If you want to manage files stored in Object Storage Service (OSS) based on FTP, you
can install ossftp. For more information, see Overview.
After ossftp receives a common FTP request, ossftp maps operations on files and folders
as operations on OSS.