The most common protocols for file transfer in use today are FTP, FTPS and SFTP. While these protocols may sound the same, there are some key differences among them. Learning these differences can eliminate some of the common problems experienced when performing a file transfer.
FTP
The FTP (File Transfer Protocol) protocol has been around for quite some time. The protocol itself is described in RFC 959 which was last updated in 1985. The FTP protocol consists of two channels, the command channel and data channel. These channels are responsible for exchanging commands and data in an FTP client session.
The command channel typically runs on server port 21 and is responsible for handling the exchange of simple commands between FTP server and client. The USER and PASS commands used for authenticating an FTP user are examples of commands that are exchanged on the command channel. The command channel remains open until the client sends the QUIT command to disconnect or the server forcibly disconnects the client.
The data channel runs on temporary random ports listening on the server (passive mode) or on the client (active mode) and are responsible for exchanging data in the form of file transfers and directory listings. The LIST command used for getting a FTP server directory listing is an example of a command that opens a data channel. Unlike the command channel which remains alive during the entire FTP session, the data channel automatically shuts down once the transfer of data is complete.
FTPS
When the FTP protocol was initially drafted security was not a primary concern. Since then many things have changed and sending data over the Internet or any other insecure network without encryption is considered a big no-no. In order to address this issue a set of security extensions to the original FTP protocol were proposed in RFC 2228 that protect FTP data as it travels over the network using SSL encryption. However, just to make things more complicated, FTPS is available in two forms known as FTPS Implicit SSL and FTPS Explicit SSL.
FTPS Implicit SSL
In implicit SSL mode a required SSL session is established between client and server before any data is exchanged. In other words, the use of SSL is implied because any attempt made by a non-SSL client would automatically be refused by the server. Typically FTPS implicit SSL services run on port 990.
FTPS Explicit SSL
In explicit SSL mode the client can optionally switch from unencrypted mode to SSL. This is useful in that the server can support both unencrypted FTP and encrypted FTPS sessions on a single port, typically port 21. In an explicit SSL session the client first establishes an unencrypted connection to FTP service. Prior to sending user credentials, the client then requests that the server switch the command channel to an SSL encrypted channel using the client AUTH TLS or AUTH SSL commands. Upon successful setup of the SSL channel the client then sends user credentials to the FTP server. These credentials along with any other commands sent to server during the FTP session are automatically encrypted by the SSL channel.
SFTP
SFTP is most often confused with FTPS and vice-versa. However, unlike FTP and FTPS these protocols are not at all related. SFTP is actually a sub-system of the SSH (Secure Shell) protocol and typically runs on port 22. Unlike FTP/S, SFTP does not have the concept of separate command and data channels. Instead both data and commands are transferred in specially formatted packets via a single connection. Furthermore, unlike FTPS explicit SSL, SFTP encrypts the entire session and does not offer the ability to switch between unencrypted and encrypted mode.
