Theme

Understanding FTP and its variants ​

FTP (File Transfer Protocol) is a standard network protocol for transferring files between a client and a server. Anyone who administers a file server needs to understand its variants, and what each of them means for security and for the network configuration.

Plain FTP ​

Plain FTP is the original, unencrypted version of the protocol. It typically uses port 21 for the control connection and port 20 for data transfers in active mode. It is inherently insecure: data and credentials travel in clear text.

Implicit FTPS ​

Implicit FTPS was an early attempt to secure FTP with SSL/TLS. It uses port 990 for the control connection and assumes that the connection is encrypted from the first byte. While more secure than plain FTP, it is considered deprecated and not every modern client supports it.

Explicit FTPS (FTPES) ​

Explicit FTPS, also known as FTPES, is the current standard for secure FTP transfers. It uses the same port as plain FTP (21), and the client requests encryption at the beginning of the session with the AUTH command. It is more flexible and supported by every modern FTP client.

Active versus passive mode ​

The difference between active and passive mode matters for the network configuration.

  • Active mode (PORT). The client opens a port and waits for the server to connect back to it. This often fails through firewalls and NAT devices, because the server's connection to the client is an unsolicited inbound connection from the client's point of view.
  • Passive mode (PASV). The client initiates both the control connection and the data connection to the server. This is much friendlier to firewalls.

TIP

Always use passive mode unless client and server are on the same LAN. Active mode fails often as soon as routing, firewalls and NAT are involved.

Security considerations ​

When setting up an FTP service:

  1. Use FTPES whenever possible.
  2. Configure your firewall to allow passive connections, by forwarding the ports of your server's passive port range, and set the public address to advertise when the server sits behind NAT (see Plain FTP data connections fail behind a firewall that rewrites PASV).
  3. Keep the server software current.

In Syncplify Server! the FTP page of the Admin UI holds the TLS settings, the passive mode addressing, and a toggle to allow or refuse active mode altogether; the manual describes it in FTP / FTPS / FTPES.

Remember that, powerful as it is, FTP has limitations that can make it unsuitable for secure and efficient transfers. Unless a protocol of the FTP family is your only option, SFTP, a subsystem of SSH-2 with no relation to FTP at all, is almost always the better choice: SFTP and SCP explains it.