FTPS — TLS for FTP

FTP added TLS via two paths:

Implicit FTPS (FTPS):

• Connect to port 990. TLS from byte 1.
• Same as HTTP vs HTTPS.

Explicit FTPS (FTPES) — more common:

• Connect to port 21 cleartext.
• Issue AUTH TLS command.
• Server replies 234 Proceed with negotiation.
• TLS handshake.
• Subsequent control commands encrypted.

C: AUTH TLS
S: 234 AUTH TLS successful
[TLS handshake]
C: USER alice
S: 331 Password required
C: PASS s3cret
S: 230 Login OK
C: PBSZ 0
S: 200 PBSZ set to 0
C: PROT P
S: 200 Protection level set to P (Private)
C: PASV
S: 227 Entering Passive Mode ...
[data connection over TLS]

PBSZ + PROT:

• PBSZ (Protection Buffer Size): legacy, set to 0.
• PROT P: encrypt data channel (Private).
• PROT C: clear (default; data channel cleartext).

After PROT P, every data connection is wrapped in TLS.

Limitations:

• Two TLS sessions per transfer (control + data). Slow.
• Firewalls can't snoop control channel → data ports unknown → must pre-open range.
• Many implementations have bugs.

Compare to SFTP (SSH File Transfer Protocol):

• Single connection; pure SSH.
• Standard TLS-style key auth.
• Works through NAT trivially (one outbound port).
• Modern, simpler, secure.

Why is FTP still used despite SFTP existing? Legacy. Lots of FTP clients/scripts; institutional inertia.

For new deployments:

• HTTPS upload (PUT).
• S3 pre-signed URLs.
• SFTP (OpenSSH).
• WebDAV (rare).

Skip FTP for new systems.