Why isn't FTPS, SFTP, or other protocols which use SSL/SSH on port 443/22?

Question

ANSWER ON THE BOTTOM

I'm in the process of taking my Security+ exam, and I was taught by the professor teaching me that, when trying to figure out what port to put a protocol on (as there are a LOT of ports), if the protocol is combined with SSH or SSL, then the port number is by default 22 and 443 respectively. Fair enough, easy to do.

Now I'm studying and I see FTPS, which I interpreted to mean File Transfer Protocol combined with Secure Socket Layer (FTP + SSL), correct? So why then isn't on 443?

I did a bit of research on it, and it appears that there are several ports that need to be opened in order to maintain compatibility or something (according to https://en.wikipedia.org/wiki/FTPS#Methods_of_invoking_security), but even then, the ports are 990 and 989.

I can understand if one of the ports is 443 while the other is on another port, but I don't understand why NONE of it is on 443. Why is that?

Is it because of the older FTP clients not being compatible? The above link mentioned about compatibility, but I wanted to make sure that was the case.

ANSWER -- it seems that I was misinformed. In the case of SFTP, SFTP actually has nothing at all to do with FTP. While it does carry similarities, the 2 are completely different. FTP is its own standalone protocol that has its function. SFTP, however, is not FTP with SSH added to it. SFTP is literally SSH with functionality similar to FTP. SFTP actually IS SSH, it's just SSH with a dedicated ability to transfer files over that specific port.

In reality, if they're not extensions of SSH like above, then most protocols that add in SSH or SSL (IMAP vs IMAPS/SMTP vs SMTPS) on top of their existing protocols, they have defined ANOTHER port number, in order to signify their intentions when they connect to that specific port.

- IMAP is port 143, but IMAP/S is port 993

- SMTP is port 25, but SMTP (Secure) is 465

- POP3 is 110, but POP3 (Secure) is 995

Answer 1

Ports are an endpoint for communication and usually represent services running.

I think your professor meant that a service using SSH or SSL would internally interact with the SSH and SSL services running on ports 22 and 443 respectively.

It does not however mean that a service, say HTTP (whose port is 80, usually) runs on 443 when serving with SSL/TLS enabled.

Also, port numbers vary. You can usually run any service on any port that isn't already occupied/reserved.

Answer 2

443 is allocated to HTTPS. Wikipedia has a list of the port allocations, and of course IANA has a list too. (It's rather long.) I don't know if there's any order in the allocations, but if there is, it isn't very obvious. Might be just "what was available at the time". As for TLS versions of old protocols, consider that HTTP is at 80, and HTTPS at 443, but (say) IMAP is at 143, but IMAPS at 993.

Also, there's things like SMTP, that are usually used with STARTTLS, that is, the TLS negotiation is done after the protocol is started in plaintext. In which case it's the same port for plaintext and TLS-encapsulated traffic... (namely 25 for SMTP). There's another port that has been used for SMTP/TLS: 465, but it's considered obsolete, and doesn't appear in the IANA list.