FTPS

What is FTPS?

FTPS (FTP Secure, also called FTP over TLS) is an extension of the File Transfer Protocol (FTP) that encrypts the control and data connections with TLS and lets the server identify itself with an X.509 certificate. The standard is defined in RFC 4217 (October 2005), which builds on the general FTP security extensions of RFC 2228 (1997). FTPS keeps the structure of FTP, with text commands, a separate data connection per transfer and active or passive mode, but ensures that passwords and files no longer travel in readable form across a TCP/IP network.

In OT environments, FTPS matters mainly when a device or application supports FTP variants but not SFTP. Many PLC communication modules and older software packages fall into that category.

🧠 How does FTPS work?

In the common explicit variant, the session starts as an ordinary FTP connection on TCP port 21, after which the client asks for encryption:

1. Connect - the client opens the control connection to port 21 and receives the greeting code 220.
2. AUTH TLS - the client requests TLS; the server replies 234 if it accepts the request. The TLS handshake follows.
3. Verify the server certificate - the client checks the server’s X.509 certificate. Only if it is valid can the client be sure it is talking to the intended server.
4. Log in - USER and PASS now travel through the encrypted tunnel. Optionally, the server can also require a client certificate.
5. PBSZ 0 and PROT P - these two commands switch on protection of the data connections. PROT P (Private) means every data connection is also set up with TLS; PROT C (Clear) leaves the data unencrypted.
6. Transfer - each RETR, STOR or LIST opens a new data connection with its own TLS handshake.

According to RFC 4217, data connections start in Clear by default. A client that forgets PROT P therefore encrypts the password but not the files. The Safe (S) and Confidential (E) protection levels from RFC 2228 are not used with TLS.

🔄 What is the difference between explicit and implicit FTPS?

The drawback of explicit FTPS is that a misconfigured server also accepts plain FTP logins. Always configure the server so that encryption is mandatory. In vsftpd, a widely used FTP server on Linux, this is done with force_local_logins_ssl and force_local_data_ssl; implicit FTPS is off by default there (implicit_ssl=NO).

🔍 What is the difference between FTPS, SFTP and FTP?

FTPS and SFTP have similar names but are not interchangeable: an SFTP client cannot connect to an FTPS server and vice versa. FTPS fits well in an environment that already has a PKI and certificate management; SFTP fits better where administrators already work with SSH keys. For new integrations between applications, HTTPS with a REST interface is often a third, simpler alternative.

🧱 Why is FTPS difficult with firewalls and NAT?

With plain FTP, a firewall with an FTP helper reads the server’s PASV reply and temporarily opens the right data port. With FTPS that reply is encrypted, so the helper sees nothing. The same applies to NAT: the server itself must put the correct external IP address in its reply.

The usual solution consists of three settings:

• Passive mode - let the client set up the data connection; active mode is barely workable behind firewalls.
• Fixed passive port range - restrict the server to a small range, for example 50000-50100, and allow only that range through the firewall (in vsftpd with pasv_min_port and pasv_max_port).
• External address - configure the public or routed IP address on the server when it sits behind NAT.

RFC 4217 also describes the use of CCC (Clear Command Channel, originally from RFC 2228), a command that returns the control connection to plaintext after login so a firewall can read the commands. The RFC itself warns about the security implications; in an OT network, a fixed port range is almost always the better choice.

🏭 Where is FTPS used in OT?

• PLC communication modules - Siemens describes in an application example how the CP 1543-1 for the S7-1500 works as an FTPS server and client. Siemens communication processors are designed for FTP and FTPS rather than SFTP, so FTPS is the encrypted option there.
• HMI and SCADA - export of recipes, alarm logs and reports to a central server.
• Data exchange with third parties - measurement data from a historian to a laboratory, grid operator or supplier, often via an FTPS server in the DMZ.
• Firmware and configurations - retrieval of files by devices that do not support SFTP.
• IT servers - Microsoft IIS and vsftpd offer FTPS built in, so existing FTP integrations can be encrypted without new software.

Because PLCs and panels in legacy systems often stay in service for twenty years or more, FTPS is in practice often the only feasible step between unencrypted FTP and a completely new interface.

🔐 What are the risks and pitfalls of FTPS?

FTPS is only as strong as its configuration. The most common mistakes:

• No certificate validation - clients that accept any certificate, or a self-signed certificate without a pinned fingerprint, allow a Man-In-The-Middle attack and spoofing.
• PROT C or no PROT P - the password is protected, the files are not. Wireshark shows this immediately.
• Outdated TLS versions - TLS 1.0 and 1.1 were deprecated in 2021 (RFC 8996). Older embedded FTPS implementations sometimes support nothing newer.
• Data connection takeover - without TLS session reuse or client certificates, an attacker could in theory hijack a data connection, similar to session hijacking. Servers such as vsftpd therefore require by default that the data connection resumes the TLS session of the control connection (require_ssl_reuse=YES); some clients do not support this, which results in error code 522.
• Weak accounts - encryption does not help against default passwords or shared accounts without access control.

IEC 62443 and ISO 27001 do not mention FTPS by name, and like other security standards they set requirements rather than prescribe protocols. IEC 62443-3-3 requires communication confidentiality (SR 4.1) and integrity (SR 3.1), and ISO 27001:2022 contains controls for information transfer (A.5.14) and the use of cryptography (A.8.24). A properly configured FTPS connection helps meet those requirements.

🛠️ How do you configure FTPS securely?

A practical approach for an OT environment:

1. Inventory - determine which devices use FTP today and whether their firmware supports FTPS, SFTP or neither.
2. Choose - SFTP where possible, FTPS where only FTP variants are possible, and isolation where even FTPS is missing.
3. Segment - place the FTPS server in a separate zone following the zones and conduits model and restrict traffic with network segmentation.
4. Harden - disable unused functions as part of hardening and verify hashes of transferred firmware.
5. Monitor - enable logging of logins and transfers and watch for expiring certificates.

For organisations covered by the Dutch Cybersecurity Act, the national implementation of NIS2, encrypted file transfer and certificate management are part of the appropriate measures for network and information security.

❓ Frequently asked questions

Is FTPS the same as SFTP?

No, FTPS and SFTP are two different protocols. FTPS is classic FTP with TLS encryption and X.509 certificates, whereas SFTP is a subsystem of SSH that works over a single connection on port 22.

Which ports does FTPS use?

Explicit FTPS uses TCP port 21 for the control connection, implicit FTPS uses port 990. FTPS also needs data ports, which in passive mode are usually a fixed range of high ports that the administrator sets on the server.

Is FTPS secure?

FTPS is secure when TLS 1.2 or 1.3 is mandatory, the client verifies the server certificate and the data connection is encrypted with PROT P. With weak settings, such as accepting any certificate or unencrypted data, FTPS offers far less protection than its name suggests.

Why does FTPS not work through my firewall?

FTPS often fails through a firewall because the firewall cannot read the encrypted commands and therefore does not know which data port to open. The solution is passive mode with a fixed port range on the server and a firewall rule for exactly that range.

What is the difference between FTPS and FTPES?

FTPES is a common name for explicit FTPS, where the connection starts on port 21 and switches to TLS with AUTH TLS. Implicit FTPS starts TLS immediately on port 990 and is not defined in an RFC.

Should I choose FTPS or SFTP in an OT environment?

In an OT environment, SFTP is usually the first choice because it uses one port and is easy to segment. FTPS is the right choice when PLC modules, HMIs or existing applications only support FTP variants, as with many Siemens communication processors.

📌 In summary

FTPS secures the existing FTP protocol with TLS without changing how commands and data connections work. That makes it a practical step for industrial equipment that does not support SFTP, but it requires attention to certificates, PROT P, TLS versions and firewall ports.

FTPS is FTP with TLS encryption and server certificates: choose explicit FTPS with mandatory encryption, a fixed passive port range and certificate validation, and use it mainly where SFTP is not an option in OT.