S E C U R E

Loading

File Transfer Protocol (FTP) is a way to transfer files between hosts over the internet. It is especially helpful as a way to upload or download files to or from a site quickly. FTP clients allow connections from both anonymous and registered users. When the goal is to limit who can perform the file transfer, the log in is often set up to require a username and password, while content that is meant to be distributed widely is often set up with an anonymous FTP login

The most common protocols used in file transfer today are FTP, FTPS and SFTP. While the acronyms for these protocols are similar, there are some key differences among them, in particular how data are exchanged, the level of security provided and firewall considerations. Learning these key differences can help you when choosing a file transfer protocol or troubleshooting common connection issues.


FTP

The FTP (File Transfer Protocol) protocol has been around for quite some time. Among the various file-transfer options, one should never, ever, ever connect to a remote server via FTP

Data Exchange

The FTP protocol exchanges data using two separate channels known as the command channel and data channel.

Security

FTP is not secure. Using FTP both the command and data channels are unencrypted. Any data sent over these channels can be intercepted and read.

Firewall

Server - Allow inbound connections on port 21.

Client - Allow outbound connections to port 21 and passive port range defined by server.


FTPS

While FTPS can provide equal security, it does require additional steps to deploy if one does not already have an SSL certificate.

Data Exchange

The FTP protocol exchanges data using two separate channels known as the command channel and data channel.

Security

Secure variants of FTP include FTPS Implicit SSL and FTPS Explicit SSL. Both utilize SSL encryption.

Firewall

Server - Allow inbound connections on port 21

Client - Allow outbound connections to port 21 and passive port range defined by server.


SFTP

SFTP is actually based on the SSH (Secure Shell) protocol which is best known for it's use in providing secure access to shell accounts on remote servers.

Data Exchange

Unlike FTP/S, SFTP does not utilize separate command and data channels. Both data and commands are transferred in specially formatted packets via a single connection.

Security

All data sent between client and server is encrypted using an agreed upon encryption cipher.

Firewall

Server - Allow inbound connections on port 22.

Client - Allow outbound connections to port 22.


SFTP Clients

There are several quality SFTP clients out there like Filezilla, Cyberduck and WinSCP. I recommend using CoreFTP which uses SFTP connections. This free, secure FTP client gives you a fast, easy, reliable way to update and maintain your website via SFTP download Core FTP LE - free Windows software




Share: