Secure File Transfer: FTP vs FTPS and SFTP

1. Basic Definition

FTP is a standard network protocol used to transfer files between a client and a server on a computer network over TCP/IP. It operates in the application layer of the OSI model and enables bidirectional file transmission (uploading from client to server, downloading from server to client).

2. Core Components

FTP Server: A host system that stores files and provides access permissions for clients, supporting functions such as user authentication and file management.
FTP Client: A software or tool (e.g., FileZilla, WinSCP) that initiates connection requests to the server, allowing users to browse, upload, download, rename, or delete files on the server.

3. Operational Modes

FTP uses two separate TCP connections to complete data transmission, with two working modes:

Active Mode (PORT Mode)
- Step 1: The client establishes a control connection with the server’s TCP port 21.
- Step 2: The client sends a PORT command to inform the server of its local port number.
- Step 3: The server initiates a data connection to the client’s specified port via TCP port 20.
- Limitation: Prone to being blocked by firewalls on the client side, as the server actively initiates connections to the client.
Passive Mode (PASV Mode)
- Step 1: The client establishes a control connection with the server’s TCP port 21.
- Step 2: The client sends a PASV command, and the server returns a random unused port number.
- Step 3: The client initiates a data connection to the server’s specified random port.
- Advantage: More firewall-friendly, widely used in modern network environments.

4. Key Features

User Authentication: By default, FTP requires a username and password to access the server (anonymous FTP is also supported, allowing access with a default account like “anonymous”).
Unencrypted Transmission: Traditional FTP transmits all data (including usernames, passwords, and file content) in plaintext, posing security risks in public networks.
Cross-platform Compatibility: Supported by most operating systems (Windows, Linux, macOS) and network devices.

5. Secure Alternatives

To address the security flaws of traditional FTP, secure variants have been developed:

FTPS (FTP Secure): Adds SSL/TLS encryption to FTP, encrypting control and data connections to prevent data eavesdropping and tampering.
SFTP (SSH File Transfer Protocol): Uses the SSH (Secure Shell) protocol for file transmission, providing end-to-end encryption and strong authentication mechanisms.