New Wi-Fi Features in Windows 7

Among enhancements to the Network and Sharing Center, there have been a couple new Wi-Fi features added in Windows 7 and Windows Server 2008 R2. Native support of Wi-Fi Protected Setup (WPS) lets admin and users more easily set up wireless routers or access points and wireless clients. Wireless Hosted Networks let you create virtual Wi-Fi networks. Advanced 802.1X settings give you more control over authentication settings when using the Enterprise mode of WPA or WPA2 security. In this article, we'll discuss each of these features.

Native Support for Wi-Fi Protected Setup (WPS) and Wireless Router Configuration

Wi-Fi Protected Setup (WPS), developed by the Wi-Fi Alliance, helps users quickly and easily configure WPA/WPA2-Personal (PSK)security on wireless routers and clients. Vendors use one or both of two different WPS configuration methods: Personal Information Number (PIN) and Push Button Configuration (PBC).

The PIN method usually consists of entering a wireless adapter's PIN into the web-based control panel of the router. This PIN can be preset and printed on the adapter or displayed and/or customized via the client software.

The Push Button Configuration (PBC) method consists of pressing a button on the wireless router and then pressing a button on the wireless adapter or computer (that supports WPS) within a minute or so. Most wireless adapters don't have physical buttons, but they may have a button on the client software if you've installed it. Similarly, wireless routers will have WPS settings available on the web-based control panel.

The exact workings of WPS can vary among hardware and software vendors. However, generally WPS works like this: It creates a WPA/WPA2 passphrase on the first WPS attempt when the wireless router is still set with the factory default settings. Any clients that participate in the first or future WPS attempts will automatically be configured with the same WPA/WPA2 passphrase. However, if some settings on the wireless router (such as the SSID) are changed from defaults before the first WPS attempt, security may not be enabled by WPS. If WPA/WPA2 security is already set via other methods, WPS will still help configure client devices with the existing WPA/WPA2 passphrase.

Microsoft started introducing its implementation of WPS in Windows Vista under the Windows Connect Now feature. The use of WPS PINs were supported but required you to initially connect via Ethernet. Windows Vista SP2 then added support for Push Button Configuration (PBC). Here we'll discuss the WPS functionality in Windows 7.

Windows 7 supports the PBC method. The first time you try to connect to a wireless router with WPS, Windows 7 prompts you to enter the security key or press the button, such as Figure 1 shows.

Figure 1: Prompt to enter PSK key or remaindering to push WPS button on the router.

If you press the WPS button on the router, the security setting will automatically be transferred to Windows 7, it will connect, and a profile will be created and stored for future connections to the router.

Windows 7 also supports the PIN method, but not in the normal sense, only when setting up the router for the first time. If Windows 7 detects that the router is using factory default settings when you try to connect, it will prompt you to setup the router, such as Figure 2 shows.

Figure 2: Prompt to setup a new wireless router.

You can proceed connecting to the unsecure signal or you can setup the router right in Windows 7. If you choose to setup the router, you'll be prompted for the router's PIN (see Figure 3).

Figure 3: Entering the WPS PIN to setup a new wireless router.

Then you'll be prompted to enter a Network Name (SSID) and optionally customize the security settings, as Figure 4 shows.

Figure 4: Entering wireless settings.

Once configured, it will display the encryption key to use on older Wi-Fi devices that don't support WPS. If you have Windows XP machines, you can even insert a USB flash drive to copy the configuration onto it.

New Wireless Hosted Networks Feature

Part of an old Microsoft project called Virtual Wi-Fi, the Wireless Hosted Network feature lets you create a virtual wireless router with a supported wireless adapter in Windows 7 or Windows Server 2008 R2.You can even host the virtual wireless network while being connected to a regular wireless network using the same wireless adapter.

You can use a Wireless Hosted Network to setup a temporary Wi-Fi network to securely share files when away from your home or office network. You could also use it to extend or share a wireless or wired network connection. It's basically an enhanced version of ad-hoc networking.

If a supported wireless adapter is detected by Windows 7 or Windows Server 2008 R2, you'll see the Microsoft Virtual Wi-Fi Miniport Adapter on the Network Connections window, such as Figure 5 shows.

Figure 5: Virtual adapter for Wireless Hosted Networks.

To get started, you'll probably first want to enable Internet Connection Sharing (ICS) to provide an Internet connection on the host network. On the Network Connections window, right-click the network adapter that's connected to the Internet via a regular network and select Properties. Select the Sharing tab, check the Allow other network users to connect through this computer's Internet connection, choose the Hosted Network Connection from the drop-down listbox, and click OK.

Next, configure the hosted network via the Command Prompt:

Netsh wlan set hostednetwork mode=allow ssid=YourVirtualNetworkName  key=YourNetworkPassword

Now start the hosted network:

Netsh wlan start hostednetwork

To stop the hosted network:

netshwlan stop hostednetwork

See Figure 6 for an example of these commands.

Figure 6: Configuring, starting, and stopping a Wireless Hosted Network.

Wireless Hosted Networks can be useful and interesting for techies, but they also can serve as another security hole on corporate networks that admins should plug. Employees may knowingly or unknowingly create a Wireless Hosted Network, opening uncontrolled wireless access to the corporate network. Though it's secured with WPA2/AES encryption, it's not controlled by the admins. If you're using a Windows Server, you might be able to prevent users from creating Wireless Hosted Networks via the Wireless Network (IEEE 802.11) Policies.

Addition of Advanced 802.1X Settings

Microsoft introduced advanced settings for 802.1X authentication in the Group Policy settings of Windows Vista. Now most of those settings are available on the GUI of Windows 7. They're accessible by clicking the Advanced Settings button on the Security tab on the Wireless Network Properties dialog (see Figure 7) and Authentication tab on the Local Area Connection Properties dialog (see Figure 8)

Figure 7: Security tab on the Wireless Network Properties dialog.

Figure 8: Authentication tab on the Local Area Connection Properties dialog.

Figure 9 shows the Advanced Settings dialog.

Figure 9: Advanced 802.1X Settings dialog.

The first section is where you can specify the authentication mode: User, Computer, or Guest. If you aren't sure, there's also the User or Computer option. When using User authentication, you can click the Save Credentials button to input the username and password. Additionally, you can remove saved credentials by marking the checkbox below.

The second section of the dialog lets you enable and configure single sign-on functionality. If supported by the system and network, configuring these settings eliminates the need to provide separate login credentials. Windows would use the Windows account credentials during the 802.1X authentication.

For wireless connections, you'll also find an 802.11 Settings tab, as Figure 10 shows.

Figure 10: Advanced Wireless802.1X Settings dialog.

Here you can enable and configure Pairwise Master Key (PMK) caching. This facilitates fast roaming between multiple wireless access points (APs). When enabled and supported by the APs, the APs will share the PMKs among themselves so clients don't have to perform pre or full 802.1X authentication when roaming to another AP—speeding up the roaming process up.

When PMK caching is enabled, you can also enable and configure pre-authentication, in case PMK caching isn't supported by an AP. Pre-authentication eliminates the need for clients to perform full 802.1X authentication when roaming to another AP—also speeding up the roaming process

On this tab you can also enable the Federal Information Processing Standards (FIPS) mode, used by non-military US government agencies and contractors.

Command-Line Tools in Windows Vista & Windows 7

Many new command-line tools were introduced with Windows Vista and Windows Server 2008, and some in Windows 7 and Windows Server 2008 R2. Some are replacements for previous tools providing enhancements and some are completely new.

auditpol

You can configure, create, backup and restore audit policies on local and remote computers. This replaces auditusr.exe.

Audit categories include account logon events, account management, directory service access, logon events, object access, policy changes, privilege use, process tracking, and system events. Enabling auditing, records the events for the specified categories in the Security log which you can access via the Event Viewer.

To retrieve the policy for the System category:

auditpol /get /category:"System"

To backup all auditing settings to a CSV-formatted text file:

auditpol /backup /file:auditpolicy.csv

To restore all auditing settings from a previously created CSV-formatted text file using /backup:

auditpol /restore /file:c:\auditpolicy.csv

bcdedit

The Boot Configuration Data (BCD) replaces boot.ini, holding the boot configuration settings. Thus the BCDEdit tool replaces the boot.ini editor bootcfg.exe. BCDEdit lets you manage the BCD stores. You can create, delete, and reorder the boot loader.

View the Boot Manager and Boot Loader details:

bcdedit

Set the default operating system:

bcdedit /default ID

Change the description of a boot entry:

Bcdedit /set ID description "THE NEW DESCRIPTION"

bitsadmin

Lets you manage file transfers made via the Background Intelligent Transfer Service (BITS). BITS uses idle network bandwidth for the file transfers, reducing impact on network performance. It's used by several Microsoft components, including Windows Update, Microsoft Update, Windows Server Update Services, and Systems Management Server.

Download a file from a URL to your hard drive:

bitsadmin /transfer DOWNLOADJOBNAME /download /priority normal http://downloadsrv/file.zip c:\file.zip

Monitor all jobs in the queue, refreshing the status every 5 seconds:

bitsadmin /monitor

Cancel all jobs in the transfer queue:

bitsadmin /reset

BITSAdmin is deprecated starting with Windows 7/Server 2008 R2 and tools for the BITS service are now provided by BITS PowerShell cmdlets.

cmdkey

Lets you manage stored user names and passwords from the Windows Credentials Manager. Though you can also access the Credentials Manager via a GUI from the Control Panel, commands can make it easier to remove and/or add login credentials for multiple PCs.

Display the list of user names and credentials:

cmdkey /list

Add a user name and password for a user to access a server/computer:

cmdkey /add:SERVER /user:USERNAME /pass:PASSWORD

(Omitting the password would prompt the user for it when logging on.)

Delete the credential stored for a server/computer:

cmdkey /delete:SERVER

icacls

This updated version of cacls lets you display, modify, backup, and restore access control lists (ACLs) and DACLs of files and directories. You can also set mandatory labels of an object for interaction with Mandatory Integrity Control.

Save the DACLs for all files and subdirectories in the C:\Windows directory:

icacls c:\windows\* /save BACKFILENAME /t

Restore the DACLs for all files and subdirectories in the C:\Windows directory:

icacls c:\windows\ /restore BACKFILENAME

Give a user Delete and Write permissions to a file:

Icacls FILENAME /grant USERNAME:(d,wdac)

mklink

This helps you create, modify and delete symbolic links, hard links, and directory junctions. Symbolic links are soft links, essentially just a shortcut folder or file that when double-clicked on, redirects the user to the specified directory or file. Hard links are direct links that stay synchronized with the original file. It essentially creates a duplicate file that appears to be separate from the original file. Directory Junctions are hard links for directories, creating what looks like a separate duplicate directory but is linked directly to and stays in sync with the original directory.

Create a symbolic link or shortcut folder (C:\MyDocs) that redirects the user to the C:\Users\UserName\My Documents folder:

mklink /d C:\MyDocs "C:\Users\UserName\My Documents"

Create a hard link (C:\MyDocs\LinkToMyFile.txt) to the C:\Users\UserName\My Documents\MyFile.txtfile.

mklink /h C:\MyDocs\LinkToMyFile.txt "C:\Users\UserName\My Documents\MyFile.txt"

Create a directory junction (C:\MyPics) that links directly to the C:\Users\UserName\MyPictures folder:

mklink /j C:\MyPics "C:\Users\UserName\MyPictures"

query

You can display current information about application servers, objects, processes, sessions, and users on the network.

Show available application servers on the network:

Query appservers

List all processes belonging to the current user

query process

Display all active sessions:

query session

Show all users logged on the system:

query user

Show all users logged on another system:

query user /server:SYSTEMNAME

robocopy

Robocopy is an enhanced version of copy and xcopy with additional features to perform advanced file and directory copying. It can resume copying after network interruptions and preserve original timestamps, NTFS ACLs, and audit information. It also has the ability to skip files that already appear in the destination folder with identical size and timestamp and to delete files from the destination that are no longer present in the source.

Copy files from one server to another, but skipping files already in the destination:

robocopy \\SERVER1\DIRECTORY \\SERVER2\DIRECTORY*.* /S

List files over 32 MBs in size:

robocopy C:\DIRECTORY /MAX:33554432 /L

Move files over 14 days old:

robocopy C:\SOURCEDIRECTORY C:\DESTINATIONDIRECTORY /move /minage:14

rpcping

It enables you to ping a server using a remote procedure call (RPC) and to confirm the RPC connectivity. It's most useful for troubleshooting the connection between a Microsoft Exchange Server and client. You can do simple pings or send simulated traffic of common Outlook RPC/HTTP requests. You can also verify that the client can contact the backend ports. If you receive errors, you can reference causes of common verbose responses.

Test the RPC proxy server:

rpcping -t ncacn_http -s ExchServer -o RpcProxy=RPCProxyServer -P "user,domain,*" -I "user,domain,*" -H 2 -u 10 -a connect -F 3 -v 3 -E -R none

takeown

This allows administrators to take ownership of a file or directory even if access has been denied. This can help if you're locked out of a folder or file after someone messed with the ACL. After using takeown, you may still need to adjust the ACL with icacls commands.

Change ownership of file to current admin user:

takeown /f FILENAME

Change ownership of file to the Administrators group instead of the current admin user:

takeown/a /f FILENAME

Change ownership of directory and all its files and subdirectories to current admin user:

takeown /f C:\DIRECTORY/r

wbadmin

Enables you to back up and restore your operating system, volumes, files, folders, and applications via an elevated command prompt. Wbadmin replaces the previous Microsoft Windows Backup command-line utility, NTBackup.

Create a backup of drive E and D and save the backup to drive F:

wbadmin start backup -backupTarget:f: -include:e:,d:\mountpoint

Check the status of backup operations:

wbadmin get status

whoami

This displays user, group, and privileges information for the current user.

Display the current domain and user name:

whoami

Display all the user, group, and privileges information:

whoami /all

winsat

This gives you command-line access to the assessment tools used to generate the Windows Experience Index (WEI) score introduced by Microsoft in Windows Vista. It measures various hardware performance characteristics and capabilities, and then gives a number from 1.0 and 5.9 for Windows Vista and from 1.0 and 7.9 for Windows 7.

Assess the ability of a system to display the Aero desktop effects.

winsat dwm

Assess the ability of a system to run Direct 3D applications, such as games.

winsat d3d

Assesses the performance of disk drives.

winsat disk

Assess the performance of the CPU(s).

winsat cpu

Run all assessments (data saved at %systemroot%\performance\winsat\datastore) and display results on the System dialog in Windows:

winsat formal

Display relevant system information:

winsat features

VPN Single Sign On with Windows 7

Configuring Windows 7 for VPN Single Sign On

Let's begin with a computer that has Windows 7 installed and is not yet domain-joined. Begin by logging on using the credentials of a local administrator on the computer:

Figure 1: Step 1 of configuring Windows 7 for VPN Single Sign On

Once you are interactively logged on to the Windows desktop, open the Network and Sharing Center. The next step is to create your VPN connection, and you begin doing this by clicking the Set Up A New Connection Or Network link circled in red below:

Figure 2: Step 2 of configuring Windows 7 for VPN Single Sign On

In the Set Up A Connection Or Network wizard, click the Connect To A Workplace option as shown below. If the user of the computer is going to be using a dial-up modem connection instead of a VPN tunnel over the public Internet, select the fourth option in this wizard page instead and proceed similarly to the steps that follow.

Figure 3: Step 3 of configuring Windows 7 for VPN Single Sign On

In the Connect To A Workplace wizard, click the Use My Internet Connection (VPN) option as shown next:

Figure 4: Step 4 of configuring Windows 7 for VPN Single Sign On

On the next wizard page, specify a FQDN or IP address for the VPN server the user will use to connect to the corporate network, and type a friendly name for this connection as shown below. Also be sure to select the Allow Other People To Use This Connection checkbox as shown below. Selecting that checkbox is important since it makes the System built-in identity the owner of the VPN connection and not the user (Karen) who is configuring the connection on the computer, and that will allow other users of the computer to perform VPN SSO logon. And if the user of the computer will be using his smart card for logging in, be sure to select the Use A Smart Card checkbox as well. Finally, if the computer you are configuring is not currently connected to the Internet, you can select the Don't Connect Now option which will set up the new VPN connection but not initiate it until you manually choose to do so later.

Figure 5: Step 5 of configuring Windows 7 for VPN Single Sign On

On the next wizard page, type the credentials that will be used for logging on to the domain. In this case, Karen Berg is configuring the computer for her own personal use, so she enters her own credentials here.

Figure 6: Step 6 of configuring Windows 7 for VPN Single Sign On

Finish the wizard to set up the new VPN connection. Once this is done, the user can click the Network icon in the notification area of the taskbar, and a popup window will appear showing the newly created VPN connection:

Figure 7: Verifying the VPN connection.  

To complete setting up her computer, Karen now joins her computer to the domain. If she is in the office, she can do this by connecting the computer to a LAN drop, clicking Start, and right-clicking Computer to open the System Control Panel item. Then she clicks Change Settings and join her computer to the domain the usual way. If she is on the road sitting in a hotel somewhere, she would first use a LAN drop in a hotel room or a secure wireless hotspot to gain Internet access and then click the Network icon in the notification area, click My VPN Connection in the popup window, click the Connect button, provide her domain credentials when prompted to do so, establish a VPN connection to the corporate network, finish logging on to her desktop, and then join her computer to the domain in the usual way.

Logging On using VPN SSO

Now Karen is on the road and she needs to access shared resources on her company's internal network over a VPN connection. To do this, she turns on her computer and waits until the logon screen appears:

Figure 8: Step 1 of logging on using VPN SSO

Karen then presses Ctrl+Alt+Del and sees the usual logon screen as shown next:

Figure 9: Step 2 of logging on using VPN SSO

Instead of typing her password, Karen clicks the Switch User button, and an additional blue button now appears near the bottom right of her screen. This button is circled in red in the next figure, and if Karen hovers her mouse over this button a tooltip saying "Network Logon" appears:

Figure 10: Step 3 of logging on using VPN SSO

Karen clicks the blue Network Logon button, and this opens a new logon screen called My VPN Connection (this was the friendly name that Karen gave to the VPN connection she created earlier). Karen now types her username and password (if she uses a smartcard then she selects the checkbox instead):

Figure 11: Step 4 of logging on using VPN SSO

After entering her credentials, Karen presses Enter and a dialog box appears indicating that the VPN connection is being established with the remote network:

Figure 12: The VPN connection is being established

Once the VPN connection has been established, the credentials Karen specified will automatically be used to log her on to the desktop of her computer. Once her desktop has appeared, she can browse shared resources on the corporate network over the VPN connection, upload and download files, and perform her work.

How to Install and Configure Windows Server 2008 DHCP Server

Installing Windows Server 2008 DHCP Server

Installing Windows Server 2008 DCHP Server is easy. DHCP Server is now a "role" of Windows Server 2008 – not a windows component as it was in the past.

To do this, you will need a Windows Server 2008 system already installed and configured with a static IP address. You will need to know your network's IP address range, the range of IP addresses you will want to hand out to your PC clients, your DNS server IP addresses, and your default gateway. Additionally, you will want to have a plan for all subnets involved, what scopes you will want to define, and what exclusions you will want to create.

To start the DHCP installation process, you can click Add Roles from the Initial Configuration Tasks window or from Server Manager à Roles à Add Roles.

Figure 1: Adding a new Role in Windows Server 2008

When the Add Roles Wizard comes up, you can click Next on that screen.

Next, select that you want to add the DHCP Server Role, and click Next.

Figure 2: Selecting the DHCP Server Role

If you do not have a static IP address assigned on your server, you will get a warning that you should not install DHCP with a dynamic IP address.

At this point, you will begin being prompted for IP network information, scope information, and DNS information. If you only want to install DHCP server with no configured scopes or settings, you can just click Next through these questions and proceed with the installation.

On the other hand, you can optionally configure your DHCP Server during this part of the installation.

In my case, I chose to take this opportunity to configure some basic IP settings and configure my first DHCP Scope.

I was shown my network connection binding and asked to verify it, like this:

Figure 3: Network connection binding

What the wizard is asking is, "what interface do you want to provide DHCP services on?" I took the default and clicked Next.

Next, I entered my Parent Domain, Primary DNS Server, and Alternate DNS Server (as you see below) and clicked Next.

Figure 4: Entering domain and DNS information

I opted NOT to use WINS on my network and I clicked Next.

Then, I was promoted to configure a DHCP scope for the new DHCP Server. I have opted to configure an IP address range of 192.168.1.50-100 to cover the 25+ PC Clients on my local network. To do this, I clicked Add to add a new scope. As you see below, I named the Scope WBC-Local, configured the starting and ending IP addresses of 192.168.1.50-192.168.1.100, subnet mask of 255.255.255.0, default gateway of 192.168.1.1, type of subnet (wired), and activated the scope.

Figure 5: Adding a new DHCP Scope

Back in the Add Scope screen, I clicked Next to add the new scope (once the DHCP Server is installed).

I chose to Disable DHCPv6 stateless mode for this server and clicked Next.

Then, I confirmed my DHCP Installation Selections (on the screen below) and clicked Install.

Figure 6: Confirm Installation Selections

After only a few seconds, the DHCP Server was installed and I saw the window, below:

Figure 7: Windows Server 2008 DHCP Server Installation succeeded

I clicked Close to close the installer window, then moved on to how to manage my new DHCP Server.

How to Manage your new Windows Server 2008 DHCP Server

Like the installation, managing Windows Server 2008 DHCP Server is also easy. Back in my Windows Server 2008 Server Manager, under Roles, I clicked on the new DHCP Server entry.

Figure 8: DHCP Server management in Server Manager

While I cannot manage the DHCP Server scopes and clients from here, what I can do is to manage what events, services, and resources are related to the DHCP Server installation. Thus, this is a good place to go to check the status of the DHCP Server and what events have happened around it.

However, to really configure the DHCP Server and see what clients have obtained IP addresses, I need to go to the DHCP Server MMC. To do this, I went to Start à Administrative Tools à DHCP Server, like this:

Figure 9: Starting the DHCP Server MMC

When expanded out, the MMC offers a lot of features. Here is what it looks like:

Figure 10: The Windows Server 2008 DHCP Server MMC

The DHCP Server MMC offers IPv4 & IPv6 DHCP Server info including all scopes, pools, leases, reservations, scope options, and server options.

If I go into the address pool and the scope options, I can see that the configuration we made when we installed the DHCP Server did, indeed, work. The scope IP address range is there, and so are the DNS Server & default gateway.

Figure 11: DHCP Server Address Pool

Figure 12: DHCP Server Scope Options

So how do we know that this really works if we do not test it? The answer is that we do not. Now, let's test to make sure it works.

How do we test our Windows Server 2008 DHCP Server?

To test this, I have a Windows Vista PC Client on the same network segment as the Windows Server 2008 DHCP server. To be safe, I have no other devices on this network segment.

I did an IPCONFIG /RELEASE then an IPCONFIG /RENEW and verified that I received an IP address from the new DHCP server, as you can see below:

Figure 13: Vista client received IP address from new DHCP Server

Also, I went to my Windows 2008 Server and verified that the new Vista client was listed as a client on the DHCP server. This did indeed check out, as you can see below:

Figure 14: Win 2008 DHCP Server has the Vista client listed under Address Leases

With that, I knew that I had a working configuration and we are done!

IIS 7.0 - FTP Publishing Service – Part 3: Securing an FTP site

Configure a secure FTP site using a commercial SSL

Below I will describe how to secure an existing FTP site using a SSL certificate. The certificate issued and used below will be created on an internal Certificate Authority made for testing purpose only, but the certificate enrollment process on the server is the same as when ordering a certificate from a third party certificate provider such as Verisign or Godaddy. It is also possible to create a self-signed certificate directly from within IIS, this process will be described later in the article.

Make sure you have the FTP site running and that you are able to log in to the FTP site. The FTP site used as example in this article ftp.example.com as illustrated below.

1. Start the IIS Manager found at Start – Administrative Tools – Internet Information Service (IIS) Manager
2. In IIS Manager click the FTP server and mark the server and choose Server Certificates:

Figure A: Server Certificates

3. In the actions pane, choose Create Certificate Request:

Figure B: Server Certificates - Actions

4. In the dialog windows that pops up, fill out the required information for the certificate and click Next:

Figure C: Self-signed Certificate - Name

5. Choose the default cryptographic service provider and click Next:

Figure D: Cryptographic Service Provider

6. Save the request to a file and click Finish:

Figure E: Save Certificate request

The certificate request has now been done and is pending in IIS. The request is now ready to be sent off to a commercial 3rd party certificate provider (e.g. Verisign, Godaddy etc.).

Import Certificate request

When the certificate request gets back from the certificate provider, it needs to be imported into IIS to work.

1. In IIS Manager click the FTP server and choose Server Certificates:

Figure F: IIS Manager – Server Certificates

2. Choose Complete Certificate Request…:

Figure G: Server Certificates – Complete Certificate Request

3. Select the Certificate request, that came back from the certificate provider and enter the common name of the site and click OK:

Figure H: Complete Certificate Request

4. The certificate is now displayed in the IIS Manager and ready for use:

Figure I: Server Certificates

Enable the commercial certificate on the FTP site

When imported the SSL certificate can be enabled and applied to an FTP site. Go to the FTP site, which you want to apply the certificate to.

1. In IIS Manager select the FTP site and click FTP SSL Settings:

Figure J: FTP site – FTP SSL Settings

2. Select the certificate and the SSL policy (Allow or Required SSL) settings and click Apply:

Figure K: FTP SSL Settings

3. The SSL certificate has now been applied to the FTP site:

Figure L: FTP SSL Settings

The FTP site is now secured and requires the connection to the FTP site to be FTP-S, using a FTP client which supports FTP-S.

Configure a secure FTP site using a self-signed SSL

As described previously it is also possible to generate a self-signed SSL certificate, directly from within the Internet Information Services (IIS) Manager. This process is quicker, than compared to requesting a commercial certificate. Self-signed certificates are great for testing FTP sites or maybe internal use, but not recommended for production use.

1. Start the IIS Manager found at Start – Administrative Tools – Internet Information Service (IIS) Manager
2. In IIS Manager click the FTP server and choose Server Certificates:

Figure M: Server Certificates

3. In the actions pane, choose Create Self-Signed Certificate:

Figure N: Server Certificates - Actions

4. In the dialog windows that pops up, give the certificate a friendly name and click OK:

Figure O: Self-signed Certificate - Name

5. The certificate is now generated and ready for use:

Figure P: Server Certificates – Generated certificates

Next step is to apply and enable this new certificate on an existing FTP site.

6. Select the FTP site (in this example: ftp.example.com) and click on FTP SSL Settings:

Figure Q: FTP site – FTP SSL Settings

7. Choose the certificate and select the settings needed (Require SSL Connections) and click apply:

Figure R: FTP site – FTP SSL Settings

The FTP site is now ready to be used and all traffic will be encrypted. An FTP client that supports FTPs is now required to connect to the new FTP site.

Connecting to an FTP site

Use an FTP client which supports FTP-S to connect to the FTP site and test the connectivity. In the example below FileZilla is used. It is important to configure the FTP server setting in FileZilla to connect using FTPs, with FileZilla the settings would be "FTPES - FTP over explicit TLS/SSL".

Figure S: FileZilla – FTPS Settings

The first time you logon to an FTP site running with a self-signed certificate, the FTP client (FileZilla) will prompt and tell you that the root of the certificate is not known. If you want to trust it and import it, click OK.

The FTP site is now ready to be used in a secure manner.

Summary