Running Serv-U under NETWORK SERVICE

Serv-U (http://www.Serv-U.com/) is a file server that allows end users to transfer files via FTP, FTPS, SFTP, web browsers, and mobile devices. Serv-U runs on both Windows and Linux and supports IPv4 and IPv6 networks. In addition, it runs natively on both 32-bit and 64-bit versions of Windows and Linux, taking advantage of performance benefits inherent in 64-bit computing. 

By default, Serv-U runs as a System Service.

On Windows, Serv-U Service can run under any account. By default, on versions before 15.3.2 the Serv-U Service account was Local System (also called SYSTEM). Running Serv-U under SYSTEM was determined to be a source of vulnerabilities because it is a built-in account with unlimited access to the OS and User resources.

Therefore, starting with 15.3.2, the default account is NETWORK SERVICE (not to be confused with NETWORK account). NETWORK SERVICE is also a built-in account, but it has well-balanced privileges and does not allow the modification of vital OS resources and access to the data residing in user-protected areas (for example, to a user's documents).

On Linux, the root is the only account under which Serv-U Service can run.

Running Serv-U under SYSTEM was determined to be a source of vulnerabilities because it is a built-in account with unlimited access to the OS and User resources, so it has been replaced in 15.3.2 with the NETWORK SERVICE account.

Resources

On Windows, Serv-U requires the following special resources to run:

1. Serv-U Default Certificate (read-only).
2. Serv-U program data directory. By default, the directory is:
   
   C:\ProgramData\RhinoSoft\Serv-U
   
   An alternative path would be the Serv-U Installation directory, which by default is:
   
   C:\Program Files\RhinoSoft\Serv-U.
   
   In this case, the files to access for read, write, create, and delete purposes are the following:
   
   <install dir>\Serv-U.Archive
   <install dir>\Users
   <install dir>\Shares

The following actions automatically provide the required access to the mentioned resources:

• Installing Serv-U by means of the Serv-U Setup program:
  
  
• Telling the Serv-U Tray to set Serv-U to Start Serv-u as Service mode:
  
  

Verify the permission to access the Serv-U Default Certificate

To verify that Serv-U can use the default certificate:

1. From the command line, start the local computer certificate manager:
   
    
2. In the started Certificate Manager, launch Manage Private Keys for the certificate ftp.serv-u.com that resides in Certificates – Local Computer\Personal\Certificates storage:
   
   
3. Verify "read" permission is granted to NETWORK SERVICE. If not, add it manually:
   
     

Verify the permission to access the Serv-U program data

1. In Windows File Explorer, open the Properties box for the Serv-U Program Data directory:
   
     
2. Verify there is "full control" permission granted to NETWORK SERVICE. If not, add it manually:
   
     
   
   If the Serv-U Program Data directory is the same as the Serv-U install directory, use the install directory (by Default it is C:\Program Files\RhinoSoft\Serv-U). When this permission is granted, the service account will allow Serv-U to automatically apply the required access rights to the data files, such as:
   
   <install dir>\Serv-U.Archive
   <install dir>\Users
   <install dir>\Shares
3. You will need to give additional permission for the network service in all of your Serv-U related directory folders including the Rhinosoft folder from the Program Files and Program Data, your certificate and SSH key folder (Serv-U console> Global and Domain> Limit & Settings > Encryption), log folder, and all the local home directories of your users.