FTP is a standardized protocol for file exchange. A client can use it to upload and download files and manage directories on a server, provided its permissions allow this. FTP is still found in older applications and automated exchange processes.
How does FTP work?
FTP uses separate TCP connections for control and data transfer. The control connection usually runs over port 21. Sign-in and commands are exchanged over it. An additional data connection is established for files and directory listings.
- Active mode: The server establishes the data connection to the destination specified by the client.
- Passive mode: The server tells the client a data port; the client also establishes this connection.
This separation is relevant for firewalls and NAT. Opening port 21 alone is often not enough for a working transfer. Passive port ranges and permitted remote endpoints should be configured specifically.
Distinguishing FTP, FTPS, and SFTP
Unencrypted FTP itself offers no protection against eavesdropping on passwords or transferred content. It is therefore unsuitable for confidential data over untrusted networks.
FTPS adds TLS to FTP. Client and server must require secure connections and validate certificates. The data channel must also be protected; an encrypted sign-in alone does not automatically secure every file transfer.
SFTP is a different protocol that works over SSH. It is neither identical to FTP nor merely another name for FTPS. Both sides of a transfer must support the same method.
What companies should keep in mind
For new exchange processes, a suitable encrypted method should be agreed. First inventory existing FTP dependencies before access is switched off or migrated.
Service accounts need only the required directory permissions. Credentials do not belong unprotected in scripts or freely accessible configuration files. Logging, error handling, and checking that files have arrived completely make automated processes traceable.
If an older application must temporarily keep FTP, network segmentation and a controlled VPN tunnel can further restrict the transfer path. This does not replace a planned switch to a suitable method.