Kind of a bunch of stuff:

I have an FTP connection to my server... I removed the anomynous login for my FTP server, but in doing so it gave me the warning that if someone wanted they could snag user name/passwords anyways and access our server... I think they could anyways considering it's FTP...

1) Anyone know the simplest way to restrict access to our server through the FTP... to secure it. I need min. users to have access....

2) If I need to enable anomynous again maybe I could restrict that user from even seeing any files... anyone know how I can do this?

3) Anyone know the risks of my server obtaining a virus or spamware or anything because I know have this connection? Is it any greater then it was simply connected to the internet? I mean enormously greater... such as can a random virus be running through the net and hit my server simply because the FTP site is open?

Hey BC,

You have setup a user account for yourself instead of the anonymous connection yes?

Your much less likely to pickup any virus's or spyware by having an FTP Server than you are to just being on the net. The Sassa virus for example pritty much hit everybody that just opened up Internet Explorer. You are a little more vunerable to attack, but it's still not easy as long as you set up a username and password that is complex enough. You should be able to make that account lockout for a bit after say 3 failed connection attempts.

I looked for the failed connection attempt time dealio... can't seem to locate it on the 2003 server... any suggestions? According to what I'm reading it seems fairly simple for anyone anywhere to scan the FTP folder with some software and snag the login data... am I reading that wrong?

The user info seems to be based off what our drive is. Because of that, I have trouble limiting it to just a few users, considering it's the drive for all our daily server activity... (as my boss wanted complete access to our servers info from home)... I guess if the users I want access are the only one's who know the IP I shouldn't have to worry about... but not sure how to tell my boss that.. LOL...

NM... found the security policy... dote...

Where did you read that from? I was always under the impression that this is only the case if the server is also acting as a web server. I'll check with Hengis as he may of had more experience with this one.

I knew I had a great bookmark for this one!! Here you go: Internet Information Services > Setting up a Secure FTP Server - applies to 2K3 - if you have any queries arising, just shout