FTP in Practice | Active & Passive Modes· FTPS

FTP in Practice | Active & Passive Modes· FTPS

· 16분 읽기 · 수정 Beginner Guide
FTP in Practice | Active & Passive Modes· FTPS

이 글의 핵심

FTP control and data channels, Active vs Passive, FTPS and SFTP compared, firewall and NAT issues—beginner operations guide to file transfer.

Introduction

FTP (File Transfer Protocol) has been used since the 1970s for file exchange—still common in batch jobs, legacy systems, industrial gear, and large MFT workflows. It splits control and data channels and uses Active vs Passive modes, so firewall rules differ—often the source of “works locally, fails in prod.” By 2026, plaintext credentials make FTPS or SFTP the norm for anything security-sensitive. This article explains behavior, client/server configuration, and how to choose among FTP, FTPS, and SFTP.

After reading this post

  • Separate control (21/tcp) from data channels
  • Explain Active vs Passive and firewall/NAT impact
  • Use CLI and GUI clients for upload, download, and resume
  • Choose FTPS vs SFTP on security and ops grounds

Table of contents

  1. Protocol overview
  2. How it works
  3. Hands-on usage
  4. Security considerations
  5. Real-world use cases
  6. Optimization tips
  7. Common problems
  8. Wrap-up

Protocol overview

History and background

FTP dates to RFC 114 (1971); RFC 959 (1985) is the classic reference, later extended for IPv6, security (FTPS), and more. HTTP, S3, and cloud APIs displaced FTP for new greenfield systems, but mainframes, plant equipment, and legacy MFT still expose FTP.

OSI placement

FTP is an application-layer protocol over TCP (control 21, data varies by mode). SFTP is not FTP—it runs over SSH.

Core properties

PropertyDescription
Dual channelCommands on control; file bytes on data.
Stateful sessionLogin, CWD, interactive dialogue.
Transfer modesStream, block, compressed (implementation-dependent).
Text commandsUSER, PASS, RETR, STOR, …

How it works

Control vs data

  • Control (default 21/tcp): Auth, directory changes, transfer setup.
  • Data: Actual LIST output and file payloads.

Active mode

  1. Client opens control to server 21.
  2. For transfer, client advertises a local data port (PORT).
  3. Server initiates data connection to the client (“active” server connect). Often fails behind client firewalls that block inbound data connections.

Passive mode

  1. Control connection same as above.
  2. Client sends PASV (or EPSV) and receives server IP:port for data.
  3. Client connects outbound to the server’s data port. Server must allow the passive port range in the firewall.
sequenceDiagram
  participant C as Client
  participant S as Server
  C->>S: Control connection
  C->>S: PASV
  S->>C: Data address and port
  C->>S: Data connection
  S->>C: File transfer

Common commands (conceptual)

CommandMeaning
USER / PASSLogin (plaintext—risky).
PWD / CWDPath and cd.
LIST / NLSTDirectory listing.
RETRDownload.
STOR / APPEUpload / append.
TYPEASCII vs IMAGE (binary).
PASV / EPSVPassive mode.

Hands-on usage

CLI client (lftp example)

Option names vary—check lftp docs and set -a.

lftp -u username,password ftp.example.com
curl -u user:pass 'ftp://ftp.example.com/pub/readme.txt' -o readme.txt

vsftpd sketch (concept)

/etc/vsftpd.conf (paths vary by distro)

listen=YES
anonymous_enable=NO
local_enable=YES
write_enable=YES
local_umask=022
pasv_enable=YES
pasv_min_port=50000
pasv_max_port=50100
# pasv_address=PUBLIC_IP   # important behind NAT
ssl_enable=YES             # FTPS

Open 21/tcp and pasv_min–max in the firewall for stable Passive.

Chroot and permissions

  • Dedicated system accounts and chroot to limit writable roots.
  • Minimum permissions on upload directories.

Security considerations

Plain FTP risks

Credentials and payloads can be sniffed on untrusted networks.

FTPS (FTP over TLS)

Explicit FTPS: AUTH TLS on the control channel, then encrypt. Avoid legacy implicit 990 when possible. Keep TLS versions and certificates current.

SFTP (over SSH)

SFTP is not FTP. It runs inside SSH, with keys and encryption as first-class. Greenfield often picks SFTP.

AspectFTPSSFTP
BaseFTP + TLSSSH
Ports21 + data range (complex)22 (simpler)
Legacy toolsClassic FTP clientsSSH clients

Real-world use cases

ScenarioNotes
Legacy integrationBanks, manufacturing batch exchanges, old MFT.
Large filesClients with resume and parallel (lftp mirror).
Anonymous mirrorsPublic FTP—needs abuse controls.
Device firmwareSome devices only expose FTP—isolate networks and prefer FTPS.

Optimization tips

  • Parallel transfers: lftp mirror -P N for many files.
  • Resume: verify REST/RETR or client resume support.
  • Binary mode: use TYPE I for images and zip to avoid corruption.
  • Placement: reduce RTT with nearby relay servers.

Common problems

SymptomCheck
Passive timeoutsOpen PASV range on server firewall; set pasv_address behind NAT.
Active fails onlyClient inbound data ports blocked—switch to Passive.
Listing works, transfer failsData channel firewall or FTPS data channel TLS settings mismatch.
Mojibake filenamesClient UTF-8, server OPTS UTF8 ON support.

Wrap-up

FTP’s split channels and Active/Passive behavior interact tightly with firewalls and NAT, while plaintext is a legacy liability. FTPS hardens transport; SFTP or object APIs are the modern direction. Use this article for legacy FTP maintenance, Passive/NAT debugging, and roadmaps toward FTPS/SFTP.

References

  • RFC 959, RFC 4217 (FTPS)
  • man lftp, OpenSSH SFTP documentation

Frequently Asked Questions (FAQ)

Q. When would I use this in practice?

A. FTP control and data channels, Active vs Passive, FTPS and SFTP compared, firewall and NAT issues—beginner operations.

Q. What should I read before this?

A. Follow the previous article or related articles links at the bottom of each post to learn in sequence.

Q. Where can I study this more deeply?

A. Check cppreference and the relevant library’s official documentation. The reference links at the end of the article are also worth using.

Other articles related to this topic.

Keywords Covered in This Article (Related Search Terms)

This article covers Network, FTP, FTPS, SFTP, File Transfer, Active, Passive.