Build an FTP site on a Windows instance - Elastic Compute Service

This tutorial describes how to build an FTP site on a Windows ECS instance. When you need to transfer files to or from your Windows instance remotely, you can set up an FTP server using the Internet Information Services (IIS) role.

Prerequisites

The ECS instance has a static public IP address or is associated with an elastic IP address (EIP).
The instance runs Windows Server 2012 R2 or later.

Step 1: Add IIS and FTP service roles

Before you create an FTP site, you must add IIS and FTP services to the instance. If you have not added these services, follow these steps.

Connect to the Windows instance remotely.
On the Windows desktop, click the icon in the lower-left corner, then find and click Server Manager.
In the top navigation bar, choose Manage > Add Roles and Features.
In the Before you begin dialog box, click Next.
Select Role-based or feature-based installation and click Next.
Select Select a server from the server pool, select the target server, and click Next.
The selected server operating system is Microsoft Windows Server 2012 R2 Datacenter.
Select Web Server (IIS). In the dialog box that appears, click Add Features and click Next.
Keep the default configurations and click Next until you reach the Select role services page.
Select IIS Management Console and FTP Server, and click Next.
Click Install, wait for the installation to complete, and then click Close.

Step 2: Create a Windows user for FTP access (Optional)

Create a Windows user for FTP site authentication. If you only need anonymous users (those who provide only the username anonymous or ftp) to access the FTP site, skip this step.

In Server Manager, choose Tools > Computer Management.
In the left-side navigation pane, choose System Tools > Local Users and Groups > Users, right-click a blank area, and select New User.
In the pop-up window, set Username and Password.
Configuration details:
- Username: This example creates a Windows user named ftptest.
- Password and Confirm password: Enter a custom password.
  Important
  The password must contain uppercase letters, lowercase letters, and numbers. Otherwise, the system rejects it due to the password policy. Keep your password secure to avoid data security risks.
- Password settings: Select Password never expires.
Click Create, and then close the New User dialog box.

Step 3: Set shared folder permissions

Create a folder as the FTP site root directory. This folder requires appropriate access and modification permissions. All client file transfers go through this folder.

On the Windows instance, create a folder for the FTP site on a disk.
In this example, create a folder named ftp on drive C.
Right-click the ftp folder and click Properties.
Click the Security tab, select Everyone, and click Edit.
If Everyone is not listed, you must add it first. For instructions, see How do I handle a missing Everyone option in folder permissions?
In the pop-up window, select Everyone, select the required permissions, and click OK.
In this example, all permissions are granted.

Step 4: Add and configure the FTP site

Open Server Manager.
In the top navigation bar, choose Tools > Internet Information Services (IIS) Manager.
In the left-side navigation pane, choose Windows instance hostname > Sites, and in the right-side Actions column, click Add FTP Site.
In the dialog box, set the site information and click Next.
Configuration details:
- FTP site name: Enter a custom name. For example, ftptest.
- Content Directory: The shared folder for FTP. In this example, the ftp folder on drive C.
Set the IP address and SSL certificate, and click Next.
Configuration details:
- IP Address: Keep the default configuration.
- SSL: The following options are available. This example selects No SSL, which means no SSL encryption is required. If you need to ensure data transfer security and have an SSL certificate, set this to Allow SSL or Require SSL based on your requirements.
  - No SSL: No SSL encryption is required.
  - Allow SSL: The FTP server supports both non-SSL and SSL connections with the client.
  - Require SSL: Communication between the FTP server and the client must use SSL encryption.
- Keep the default values for other settings.
Note
When SSL is set to Allow or Require, you must select an SSL certificate. You can use an existing certificate or create one. For instructions, see How do I create a server certificate?
Set authentication and authorization, and click Finish.
Configuration details:
- Authentication: The following options are available. This example selects only Basic. The FTP site will be accessed using the ftptest user created earlier. If you have no data transfer security requirements, you can set this to Anonymous to allow anonymous users to access the FTP site directly.
  - Anonymous: Allows any user who provides only the username anonymous or ftp to access the content.
  - Basic: Requires a valid username and password to access the content. Because basic authentication transmits unencrypted passwords over the network, use this method only when the connection between the client and FTP server is secure (for example, when using Secure Sockets Layer (SSL) encryption).
- Authorization: The following access scopes are available. This example selects Specified users and enters ftptest in the text box.
  - All Users: All users (both anonymous and identified users) can access the shared folder of the FTP site.
  - Anonymous users: Only anonymous users can access the shared folder.
  - Specified roles or user groups: Only members of specific roles or user groups can access the shared folder. Enter the role or user group in the text box.
  - Specified users: Only specified users can access the shared folder. Enter the username in the text box.
- Permissions: Select both Read and Write.
The new FTP site appears in IIS Manager. After the setup is complete, the Sites list in IIS Manager displays the created ftptest FTP site with a status of Started, binding port 21, and physical path C:\ftp.
Configure the FTP site firewall.
a. In IIS Manager, double-click the FTP site name ftptest to open the FTP site home page.
b. Double-click FTP Firewall Support.
c. Configure the following parameters and click Apply:
- Data Channel Port Range: The port range used for passive connections. Valid values: 1025 to 65535. Set this based on your requirements.
- External IP Address of Firewall: The public IP address of the ECS instance.
Note
For information about why passive mode requires a range of open ports and configuration recommendations, see FTP passive mode port configuration recommendations.
d. Open the Windows Command Prompt on the instance and run the following commands to restart the FTP service:
```
net stop ftpsvc

net start ftpsvc
```

Step 5: Configure the security group and firewall

After you build the FTP site on the Windows instance, add inbound rules to the security group associated with the instance to allow traffic on the ports required by the FTP server.

Note

Set the port range based on your requirements. (Recommended) Use high-numbered ports. This example uses ports 40000 to 40100.

Add inbound rules to the security group of the Windows instance to allow traffic on port 21 and ports 40000 to 40100.
For instructions, see Add a security group rule.
Note
For more information about security group configurations, see Security group best practices and Common ports.
(Optional) Configure the Windows instance firewall.
The Windows instance firewall is disabled by default. If your firewall is enabled, allow TCP port 21 and ports 40000 to 40100 for the FTP service.
For other firewall settings, see the Microsoft documentation.

Step 6: Test FTP site access from a client

You can use Windows File Explorer, a command line interface, a browser, or third-party FTP tools to test the FTP server. This example uses a local Windows machine as the client and tests access through File Explorer.

On the local Windows client, open File Explorer and enter ftp://Public IP address of the FTP site:21 in the address bar.
After a successful connection, the File Explorer address bar displays ftp://Public IP address:21/, and the current FTP site directory is empty.
In the Log On As dialog box, enter the login credentials and click Log On.
Use the ftptest username and its password. Set User name to ftptest and enter the corresponding password.
If you access the FTP site through Windows File Explorer and the built-in Internet Explorer browser does not have Use Passive FTP enabled, FTP site access fails and returns error codes 200 and 501. To resolve this issue, enable passive FTP in Internet Explorer:
a. On the local Windows client, open Internet Explorer.
b. In the upper-right corner of the page, click the gear icon, and then click Internet Options.
c. On the Premium tab, in the settings list, select Use Passive FTP (for firewall and DSL modem compatibility).
d. Click Apply, and then click OK.
After accessing the shared ftp folder, create a test folder named test.
You can then see the test folder in the FTP site directory in Windows File Explorer, which indicates that the FTP site is accessible.
Log on to the Windows instance again. If the test folder appears in the ftp folder on drive C, the FTP site is ready. The test folder visible in the C:\ftp directory confirms that the client can access the FTP site normally.

Next steps

If you want to manage files stored in Object Storage Service (OSS) over FTP, install OSS FTP. OSS FTP receives standard FTP requests and maps file and folder operations to OSS operations.