Is it safer to use a port other than 21 for FTP?

Question

Usually (as far as I know), FTP uses port 21.

Since this port is used for FTP so often, is it safer to use another port? My guess is that if someone with malicious intentions tries to break FTP accounts, they will try port 21.

Answer 1

It is not safe to use ftp over any port. Those who have a malicious intent to get in your network or system will not scan your system for port 21 but for all ports, and will figure the other port in virtually no time.

You are better with sftp as your file transfer tool.

On the other hand, you have the option of adding some security to your ftp transfers and ports if you run it over a VPN tunnel instead.

Answer 2

The reason FTP is generally considered insecure is because it is not encrypted, which means that if someone is sniffing traffic anywhere in the network path, then everything traversing it can be read. This includes the username, password, all the data being transferred, and which port is being used.

Using a non standard port will not increase security, but it might cut down on the number of bots that attempt to connect to it, which annoyingly fill up your network logs.

Answer 3

1. If your FTP server is always kept up to date, then usually that means there are not going to be any known exploits against that application. On the other hand, if the server is out of date then you risk robots that scan for well-known vulnerabilities that otherwise would have been fixed.

2. If the FTP server is poorly configured, for example having a default username/password, or a weak password on a neglected (or privileged) account, then a brute force attack may easily be able to get through.

So now you know the two most common attacks, to answer your question specifically, yes, a non-default port number will reduce the likelihood of such an attack, especially in regards to those robots which are scanning the internet for vulnerabilities.

This is often considered Security Through Obscurity and is frowned upon due to its limited effect, but you cannot deny that it does improve your security to some degree, especially against robot vulnerability scanners. Probably not so much against a targeted attack.

Suggestions:

• Changing the Default Port is a simple thing you can do if you are not confident about the security as-is.

• The best thing to do with an FTP service is to limit the IP addresses that can access it. This prevents vulnerability scanning. For example, it is likely that there are only certain buildings in the world that you would use to access the FTP server. You do not need to allow access from any other IP address.

• It is highly recommended that you stop using FTP and switch to SFTP (SSH) to protect your credentials from getting out. FTP is unencrypted, and, while that is not applicable to your question, it is very risky to use an unencrypted connection for anything except on-site LAN access.

• Also consider using a VPN, which gives you secure remote LAN access.

Answer 4

Yes, though only in a very minor way.

With any risk assessment there is the factor of cost vs. provided security.

When you move FTP to a non-standard port, you will reduce the incoming attempts at low hanging fruit. In other words, the script kiddies trying a dictionary list on only port 21 won't be considered attackers any more. In this way it is safer.

The cost however is that all firewalls (including some outside your control) may need to be adjusted. Clients will need settings changed and users will have to follow a non-standard procedure. These are small things, but your gain is small.

On these merits alone, absent all others, it's a close call (on the is it worth it question).

That said, there are much better ways to achieve better security. An IP address white list is cheap and easy. It provides more security than port changing. VPN access for FTP is another "easy" path if you already have VPNs setup.

Using those or other methods to secure FTP is generally "cheaper" and more secure than just switching ports.

BIG SUPER IMPORTANT NOTE

While FTP has its uses it should not be considered secure. Use SFTP instead.

Answer 5

It depends on the threat model

In case of traffic sniffering changing the port doesn't make any difference. It barely helps against a human hacker, trying to analyze the system's vulnerabilities.

It will help against automatic mechanisms (botnets, worms), since they tends to assume standard ports.

Answer 6

Short story: changing port is not the way to go to secure a file transfert service.

Now for a more in depth explaination. If you have no reason to have an FTP server on a machine, the safest is to have none whatever the port. And an FTP server is seldom necessary except for a public file service. It is among the oldest protocols in the TCP/IP world and is only aimed at exchanging files. If you control both ends of the connection, said differently if all the users that will use it are known to the system with a user name and password, then you should use sftp which is a special use case of ssh. As it is build on top of ssh, all exchanges are fully encrypted, and it provides out of the box a highly secure public key authentication system. Of course, some browsers will no longer be usable (Filezilla will, thanks to @dave_thompson_085 for noticing it), but using a real password with a normal FTP server over an Internet connection is hem... poor security practice because it is passed unencrypted. In short do not do that! Anyway you can find sftp GUI clients.

FTP is still heavily used for public file servers. You can find solid implementations that have been heavily tested (meaning that implementation flaws are unlikely) and come with nice features like the ability to restart an interrupted transfer without loosing what has already been downloaded. All major Linux and BSD distributions can be found on FTP servers, because of that. But I no longer have an FTP server on my own machines for decades...

And just for the possible security increase of using a non standard port, forget your illusions: a port scan could soon reveal it, not speaking of a simple promiscuous packet scanner anywhere on the network. What is even worse, beginner admins could be tempted by installing a quickly configured FTP server on a non standard port for their own use saying that nobody will find it there so I won't spend time on securing it. The actual result is that:

• a simple port scan can reveal it
• as traffic is unencrypted any machine on the way using promicuous mode scanner will see the user and password without any alert => just imagine what can happen if the credentials give admin privileges...

And changing a well known port is likely to forbid users behind a corporate proxy to access your server.

IMPORTANT NOTE

This part is not directly related to the question itself, but on the common affirmation: FTP is unsafe, do not use it, which is not correct.

FTP was used as a secure protocol with secure authentication before ssh. It is true that is is now seldom used that way, but one time password is a way to mitigate the risk of stolen credentials. Of course anybody on a network can see the password, but as soon as it has been used it is immediately revoked. I intensively used that in the 80', and I would still be confident in OPIE or OTPW for secure connection over unsecured lines. Even if I must agree that I now use sftp and ssh instead of telnet + ftp + OPIE :-)

What I want to say is that FTP is not insecure per se and it can be securely used. Simply trivial use of FTP is generally unsafe.

Answer 7

Setting aside the question of whether it'll reduce automatic scanning (yes), and whether you can expect any security from FTP in either case (no), setting up FTP on a non-standard port can even hurt the security of your overall setup.

If you're running an FTP server on a non-standard port on the same host as an HTTP server, one can use the FTP server to perform XSS on the HTTP server on some browsers. Archive link

IIRC this works by POSTing the HTML+JS data using HTTP to the FTP server, which the browser allows because the FTP server is on a non-standard port, and so the browser doesn't know it's FTP and sees no reason to disallow this. The FTP server then responds with error messages that contain the invalid data that was posted. The response doesn't contain HTTP headers, but this just causes the browser to assume it's a HTTP/0.9 response. So, the server just gave you a response that contains the payload you sent it. At least older versions of IE ignored the port wrt. the Same-Origin-Policy, so you've got XSS on your hands, without doing anything wrong on the HTTP side of things.

I'm not sure how much of this has been mitigated (dropping HTTP/0.9 support, interpreting all HTTP/0.9 responses as text/plain, fixing the port thing on IE, etc. etc.) in modern browsers, but it definitely shows that it can have unintended consequences elsewhere. (And still has, at least if a user is using an older IE)

As for which is the lesser evil, automatic scans or XSS for [at least] some older browsers: Dude, just ditch the whole FTP thing already :)

Answer 8

Your question is really two questions. One is about the security of using FTP and the other is about the benefits of changing the default port for a network protocol.

Some people will argue that changing the default port is an example of security through obscurity. However, this is only true if this is the only security control you put in place. Changing the default port can be a legitimate security control, but only if it is also combined with other security controls. It is true that it is not a particularly strong control and anyone with a moderate level of knowledge will likely find the new port your protocol is listening on. However, it is an additional layer of protection, even if only a vary thin one and security is all about layers of protection. It may not stop an experienced person trying to crack into your system, but it may well stop many automated or simple script based attacks.

The downside with such approaches is that it does have an impact on usability. Any legitimate user of the service will now need to know the new port and will likely have to use additional command line or configuration settings to use your service. In some situations, this may be OK, but in others, it will just be inconvenient or confusing. It really depends on your situation and what you're trying to protect against.

For example, I will often move my SSH service from port 22 to a different port. While this has only a minimal impact on security, it has the benefit of avoiding the large number of automated scripts I see which attempt very simplistic attempts to access my system, reduces 'noise' in my logs and possibly has a minimal impact on services (in one location I was working in, I was seeing an average of 30k attempts to login on port 22 a day). As I was the only user with legitimate reasons to use SSH to connect to this system, changing the default port had minimal inconvenience and once I moved to the different port, I would only see a couple of attempts a week. However, this was with SSH, which is designed to be secure by default. FTP is a vary different story.

In the case of FTP, if you do nothing else other than move the default port, then it is security through obscurity and will have vary little impact on overall security - it will decrease usability and do nothing to address the fundamental weaknesses in FTP. The basic security of your system will not be improved by any significant amount as it is trivial to do a port scan and identify the new port on which the FTP service is listening.

As pointed out by some of the other posts and comments, the real problem here is that FTP is simply an insecure protocol. There are a number of functionally equivalent alternatives. Therefore, if you're concerned about security, the best course of action is simply not to use FTP. There are versions of FTP and ways to configure FTP which can make it more secure, but to a large extent, these are "after the fact" additions/extensions to the protocol and likely to still not be as secure as a protocol which had security built into it from the start. So the real answer if security is a concern is to just not use old protocols like FTP and Telnet. Use things like SCP or even SFTP and SSH or even HTTPS.

Answer 9

I think something that other answers have failed to make clear is that in the vast majority of cases on the internet, hacking traffic comes from bots which scan known ports for known services (like FTP port 21) and only act if the scan returns something useful (like an FTP server). Unless your server is likely to be the target of human hackers, you probably shouldn't worry.

Is FTP generally secure? No.

Should you use it in a publically accessible manner? No.

If you use it on port 21 on a public IP will a bot steal your data? Potentially.

If you use it on a non-standard port on a public IP will a hacker steal your data or compromise your data? Probably not.