6

I have just read RFC2228 and clients like Filezilla still seem to support it.

Te RFC says

 The following new optional commands are introduced in this
   specification:

      AUTH (Authentication/Security Mechanism),
...

So now i am confused. I use SFTP and FTPS since some years and now i wonder what is the relevance of RFC2228 today? Was it a predecessor of SFTP and FTPS which is obsolete now?

Let me explain what i mean:

When i use FTPS to encrypt my entire FTP-traffic through a TLS-tunnel, do i still need the commands described in RFC2228 for anything?

Are there any security-issues when someone use only RFC2228 (without SFTP and FTPS)?

2
  • FTPS (RFC 4217) is based on RFC 2228 and uses its commands to establish a secure FTP session, so asking whether RFC 2228 is relevant for FTPS a bit strange. Or did you actually mean the SSH-based SFTP?
    – Ja1024
    Commented Jun 19 at 4:07
  • SFTP has nothing to do with FTP other than its functionality for accessing remote files. SFTP is a distinct protocol that operates over SSH.
    – iBug
    Commented Jun 20 at 18:59

1 Answer 1

12

Are there any security-issues when someone use only RFC2228 (without SFTP and FTPS)?

SFTP and FTPS are totally different protocols. SFTP is file transfer using the SSH protocol, FTPS is classical FTP defined in RFC 959 with the addition of optional encryption for the control and data connections - as defined in RFC 2228 and enhanced in RFC 4217.

Therefore you cannot use FTPS without RFC 2228 - this RFC defines the commands needed in FTPS. Similar you cannot use SFTP with RFC 2228 - this RFC is defined only for use with classical FTP and not with a totally different protocol like SFTP.

When i use FTPS to encrypt my entire FTP-traffic through a TLS-tunnel

You cannot use FTP through a single tunnel since FTP has (contrary to SFTP) one TCP connection for the control channel and then more TCP connection with different source and destination ports than the control connection for each new data transfer. The ports for the data connections are dynamic and will be exchanged inside the control channel, so any tunnel either needs to be at the network level (i.e. a real VPN, not a TLS tunnel) or needs to watch the control channel to find out the dynamic ports in order to tunnel these.

Note that there is a variant of FTPS which does not use AUTH TLS to initiate the TLS connection on control channel (explicit TLS) and define that the data channel will use TLS, but directly starts with TLS (implicit TLS) on both control and data connections. This is similar how SMTP can be run with explicit TLS (STARTTLS, port 25 or 587) and implicit TLS is (port 465). This variant is usually used on port 990. But it was never standardized, even though it is often supported by clients and servers.

3
  • Hello Steffen. SFTP and FTPS are totally different protocols i know. maybe i should have written ... without SFTP *or* FTPS. Anyway: Thank you for your answer and explanation.
    – anion
    Commented Jun 19 at 7:55
  • 7
    @anion The point is that SFTP has absolutely nothing to do with FTP, just a similar name. Mentioning SFTP in a question about FTP does not make much sense as the technologies are completely unrelated.
    – TooTea
    Commented Jun 19 at 13:19
  • Adding to @TooTea's comment, the relationship between FTP/FTPS and SFTP is very similar to that between Java and JavaScript.
    – iBug
    Commented Jun 20 at 18:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .