Implicit FTPS and Explicit FTPS

An early version of FTPS is now known as implicit FTPS. Upon connecting, implicit FTPS clients automatically start securing the connection using SSL/TLS.

This is a problem for unencrypted FTP clients - they will no longer be able to connect on a server port that requires securing the connection immediately. If FTP and FTPS (implicit) are to be supported on the same server, they require different port numbers. Typically, implicit FTPS uses port 990 rather than the standard FTP port 21.

Explicit FTPS fixed this by requiring the AUTH command to be sent by the client prior to securing the connection. This meant that unencrypted FTP clients can connect on the same port as FTPS clients - the unencrypted clients simply never send an AUTH command and the session remains unencrypted. FTPS clients send the AUTH command prior to logging in so that credentials are secured.

Implicit FTPS clients can still be found, but explicit mode is always preferred. Unless implicit mode is required it is best to have implicit mode FTPS disabled in CompleteFTP.

Next: Securing Control and Data Channels