Why the FTP permission is WRXWRXWRX?

[Jimmy Chan]

Hi all,

I setup a Windows Server 2003 IIS and FTP. But for the security reason, I partition the HDD to two partition, one 15GB (C:) for the OS and the other 15G (D:) for the WWW and FTP usage .... but I am feeling my security setting for the IIS integration with FTP maybe wrong ...

After installed the OS, I check the D:, discovered the root of D: permission is same as C:

Here are the screen capture of my root of D: permission

http://test.wusogorphoto.net/kei/server/001.jpg

Now Let me tell you what I do for integration the IIS and FTP after the default installed OS .

1. I build a user called "abcd" and give him a password

2. Later, I following the microsoft document to build up a isolate FTP

3. I make a "virtualhost" directory under root of D:

4. under "virtualhost" I build a LocalUser directory

5. LAter I build a "abcd" under LocalUser

6. Later build up INetPub under "abcd" (for security reason of the Access Database, I want to the user's root FTP folder is in D:\virtualhost\LocalUser\abcd\, and the IIS will point to D:\virtualhost\LocalUser\abcd\INetPub\wwwroot , so other Internet can't download the access mdb file, since they don't know the root of the FTP directory is not same as the IIS one)

7. Build "wwwroot" under "INetPub"

http://test.wusogorphoto.net/kei/server/002.jpg

8. I change the FTP's default directory from "C:\inetpub\ftproot" to "D:\virtualhost"

9. I add a new web site in IIS, and point it to "D:\virtualhost\LocalUser\abcd\INetPub\wwwroot"

10. I change the FTP's "Directory listing style" under "Home Directory" from "MS-DOS" to "UNIX"

Later, I open FileZilla FTP client, and upload the file to the FTP, it work ok and can del, make new files ... but I take care of the right side of my FTP client, it show me RWXRWXRWX onthe files ....

http://test.wusogorphoto.net/kei/server/003.jpg

http://test.wusogorphoto.net/kei/server/004.jpg

But, I have make a php forum using simplemachine.org to upload the attachment by the froum, and go to the FTP client to see the files, it is R-XR-XR-X (P.S. I have add a write permission to the ISUR_MACHINE_NAME for the forum, else it can't write anything to the attachment directory), the permission is not same with the abcd account one .... why, do it will be a security hole of my web site?? Here are the screen capture

http://test.wusogorphoto.net/kei/server/005.jpg

Can anyone that can tell me my integration setting with the IIS and FTP is right or have something wrong?