DEFINITION

FTP, means file transfer protocol, computer application used to transfer files from one computer to another over a local area network (LAN) or a wide area network (WAN) such as the Internet. FTP.

File transfer protocol (FTP) is also a set of rules that computers follow for the transferring of files from one system to another over the internet. It may be used by a business to transfer files from one computer system to another, or websites may use FTP to upload or download files from a website’s server.

TYPES OF FTP

FTP

Plain, unencrypted FTP that defaults over port 21. Most web browsers support basic FTP.

FTPS

Implicit SSL/TLS encrypted FTP that works just like HTTPS. Security is enabled with SSL as soon as the connection starts. The default FTPS port is 990. This protocol was the first version of encrypted FTP available, and while considered deprecated, is still widely used. None of the major web browsers support FTPS.

FTPES

Explicit FTP over SSL/TLS. This starts out as plain FTP over port 21, but through special FTP commands is upgraded to TLS/SSL encryption. This upgrade usually occurs before the user credentials are sent over the connection. FTPES is a somewhat newer form of encrypted FTP (although still over a decade old), and is considered the preferred way to establish encrypted connections because it can be more firewall friendly. None of the major web browsers support FTPES.

These three protocols should not be confused with the SFTP protocol, SFTP is an entirely different file transfer protocol that runs over SSH2.

Restricting FTP connections at the Listener level

In addition to the fine-grain control, administrators have at the user level, broader restrictions can be enforced at the listener level. FTP listeners also have the Require Secure Control and Require Secure Data settings. These settings are checked first before a user even attempts to login. If the Require Secure Control and Require Secure Data options are specified for an FTP listener, then only secure FTPES connections will be allowed. These settings are enforced before the individual user settings are checked.

Restricting FTP connections at the User level

For a User or Group account, the Require Secure Control and Require Secure Data constraints are meant to enforce that the connection is encrypted using either FTPS or FTPES.  If Require Secure Control is checked, FTP over port 21 will be denied login if the user attempts to authenticate without upgrading the connection to use encryption. If the FTP connection is upgraded to use encryption (upgraded to FTPES), then the user will be allowed to send login credentials and attempt to login. Cerberus requires an FTP listener to allow FTP or FTPES connections.

FTPS connections are always encrypted, and connections that come through on an FTPS listener will always be allowed to attempt to login.

The user and group constraints Allow FTP and Allow FTPS is meant to control what protocol a user can login over.  If Allow FTP is selected for a user, then both FTP and FTPES connections will be allowed to attempt to login over an FTP listener. This can be further restricted to only allowing FTPES connections by selecting the Require Secure Control and Require Secure Data constraints for the user.

You can create combinations of these options to allow exactly the type of protocol and security settings that you prefer.

For example:

To allow any protocol, as long as it is secure, leave Allow FTP and Allow FTPS checked, and make sure Require Secure Control and Require Secure Data are checked.

This will allow connecting over implicit FTPS listeners on port 990, and explicit FTPES connections over FTP listeners on port 21 (as long as the connection gets upgraded to TLS/SSL encryption before the user attempts to login).

These settings are found in the ‘User Manager’ by clicking on ‘Users’ on the Cerberus Admin Portal. For a User, click on ‘Users’, select the user to edit, then click on the ‘Constraints’ tab. For a Group, click on ‘Groups’ and then select the group to edit. In both cases, the permissions are located in the ‘Property’ window on the right.

Advantages of FTP clients

• Allows you to transfer multiple files as well as directories
• The ability to resume a transfer if the connection is lost
• The ability to add items to a “queue” to be uploaded/downloaded
• Many FTP clients have the ability to schedule transfers
• No size limitation on single transfers (browsers only allow up to 2 GB)
• Many clients have scripting capabilities through command line
• Most clients have a synchronizing utility
• Faster transfers then HTTP
• Supported on almost all hosts (per Randy Downs at Downs consulting Services

Those are just a few of the advantages of using an FTP client. While the clients help make transfers easier they are not without their drawbacks.

Disadvantages FTP clients

• Usernames, passwords and files are sent in clear text
• Filtering active FTP connections is difficult on your local machine (passive is preferred)
• Servers can be spoofed to send data to a random port on an unintended computer
• Hard to script jobs
• TLS 1.2 not always supported over https (use cURL instead) (per Steve Silberberg at Fitpacking
• Easy for inexperienced users to wipe out work

In those cases you can see where using the web interface would eliminate these issues. Both FTP clients and the FTPs sites have their advantages and disadvantages. Fortunately you are able to use them hand-in-hand depending on your specific needs.

Drop your comment.