Users can be added and modified in the Cerberus FTP Server user database by opening up the User Manager and selecting the Users tab.
The Cerberus FTP Server User Manager's Users Page
To add a user, click the New button from the button group along the right side of the page. A new user popup will appear. All usernames must be unique and are case insensitive. Once you have entered the new username, continue filling out the remaining fields. The user can then be configured by clicking on the additional buttons above the details.
Individual User Settings
The additional buttons (Profile, Constraints, Authentication and Allowed Protocols) The most commonly used of these properties are as followed:
Profile Tab
Profile tab for a User
| Username | The username this account will use to login. (Required) |
| An email address to associate with the user account. This email address may be used as the 'from' address when creating public shares and the 'to' address when sending password reset emails. (Optional) | |
| First Name, Last Name, Telephone, Mobile | Optional Information fields for the user |
| Description | A description field for the user account |
| Primary Group | A Cerberus FTP Server Group that this user belongs to. All of the user's are overridden by the settings of the Primary Group. |
| Secondary Groups | Additional Groups the user is assigned to in order to add access to additional virtual directories. User settings are NOT overridden by Secondary Groups, they merely grant the user access to the virtual directories assigned to the group. |
Constraints Tab
Constraints tab for a User
| Anonymous | If checked, the user password is ignored and the user can be logged in using any password. |
| Disabled | Determines whether the account can log in or not. A disabled account cannot log in to the server. |
| Max Logins | The maximum number of connections this user can make to the server at the same time. |
| Disable Date | If a date is set here then the account will become disabled after the date specified. Note: The granularity of the timer is 30 minutes. The account will be disabled within 30 minutes of the time set. |
| Max Upload Filesize | This field can be used to limit the maximum size of an uploaded file. This value defaults to unlimited. The file size is specified in bytes. Specify 0 or any non-positive value to reset the maximum file size to unlimited. |
| Allowed IP Addresses | A comma-separated list of IP addresses that this user can log in from. If no IP addresses are specified then no per-user IP address filtering is enforced. IP addresses can be specified as a single IP, a range of IP addresses separated by a dash with no spaces, e.g. 192.168.0.100-192.168.0.150, or a CIDR-formatted IP address range. Adding spaces before and after the dash will invalidate the IP range. Multiple formats can be combined, with each single IP or range separated by a comma. Note, global IP address deny lists or allow lists are always enforced first, regardless of this setting. |
Authentication Tab
Authentication tab for a User
| SSH Authentication Method | Determines the authentication requirements for logging into an SFTP interface. Valid options are:
|
| Multifactor Authentication (2FA) | Determines if Two Factor authentication is allowed or required. |
|---|---|
| Allow 2 Factor | This option allows users to set up 2FA if they choose to |
| Require 2 Factor for HTTP/S | This makes 2FA a requirement when using the HTTP/S web client. |
| Do not allow SSH SFTP logins (No 2FA) | This option will not allow users to login via SSH SFTP when 2FA is enabled. |
| Do not allow FTP/S logins (No 2FA) | This option will not allow users to login via FTP/S when 2FA is enabled. |
| 2 Factor Authentication Status | Shows whether 2FA is currently enabled on the account.
|
Allowed Protocols Tab
Allowed Protocols page for a User
| Permitted Login Protocols | Controls which protocols a user is allowed to log in with. If a protocol is not checked then the user will not be allowed to log in using that protocol. |
| FTP Only Settings | These settings only apply when the user logs in using FTP. |
|---|---|
| Require Secure Control | If enabled, this user can only log in to the server using a secure TLS/SSL encrypted connection. |
| Require Secure Data | If enabled, file transfers will only be allowed over secure TLS/SSL encrypted connections. |
Virtual Directories Tab
See Adding a virtual directory to a user account for detailed information on how to add virtual directories to the user account.
Comments
3 comments
How do you setup a user to a specific port for FTPS explicit over TLS . eg port 989
Hello, Graham.
While you can't specify the port, you can controls which protocols a user is allowed to log in with.
If you wanted your user to use only FTPS:
Click on constraints
From here you can enable/disable the protocols you wish for the end-user to use. In your case, Only "AllowFTPS" would be checked.
We use the "allowed IP addresses" field as an extra security measure to only allow connections for that user from that IP adresses.
We also add those IP adresses in the IP Manager as allowed IP.
This works fine, but we now have an user with an IPv6 IP address. The IPv6 can be configured in the IP Manager, but not in the "allowed IP addresses" field under a user. We get the error message "Please enter one of more comma separated valid networkk addresses in doc-decimal, CIDR, or range notation.".
Is it possible to configure an IPv6 IP address in the "allowed IP addresses" field under an user? Or do we need to convert them to IPv4?
We use Cerberus Professional 11.3.5.0.
Please sign in to leave a comment.