FTPS can protect the login and still leave the file transfer exposed
FTP with TLS is usually described as a secure version of FTP, but the control channel and the data channel are separate. RFC 4217 defines extensions that let a client negotiate TLS with AUTH TLS, set protection with PBSZ and PROT, and protect subsequent commands and transfers. A service that upgrades the login but leaves the data connection in cleartext has not secured the file contents.
Use explicit TLS with verified certificates
Explicit FTPS starts with a normal control connection and then requests TLS. That makes the greeting and capability negotiation visible before the protected session begins, which is not the same as an end-to-end encrypted protocol. The client should verify the server certificate and hostname instead of accepting any certificate presented on the FTP port.
Require protected data connections for file contents. Review whether PROT P is mandatory and whether the server falls back to clear data for older clients. Disable commands that return the control connection to cleartext unless there is a specific, temporary migration need. Implicit FTPS is a vendor extension rather than the RFC 4217 model, so document it as an exception and test it with the same certificate policy.
Constrain the session
Restrict passive data ports to a documented range and firewall that range independently of the control port. If the server advertises an address that clients cannot reach, NAT and firewall changes may force insecure workarounds. Keep user home directories isolated and test path traversal, symlink handling and rename behavior with a low-privilege account.
Use separate service accounts for integrations and humans. Rotate credentials after an application change, and review scripts that store passwords in command lines or plaintext configuration. Certificate renewal needs its own owner. An expired certificate can cause clients to retry with verification disabled, which turns a maintenance error into a policy failure.
Identify the service by behavior
Port 21 is a hint, not proof that FTPS is enforced. Inspect the advertised AUTH TLS support, the certificate chain, the protected data-channel requirement and the final transfer mode. Inventory hosts that still accept cleartext FTP and distinguish them from servers that merely listen on a legacy port.
Monitor failed TLS handshakes, repeated certificate errors, anonymous login attempts and unusually large transfers. After a suspected data-channel exposure, rotate the affected credentials, determine which files were transferred, inspect server logs and notify the data owner. Re-enabling TLS without reviewing client fallback can leave the same cleartext path available.
Top comments (0)