1

For some reason connecting to server using FTP client (eg. filezilla) is not working with TLS encryption enabled. I had to disable it to use FTP. So wondering why is TLS needed in the first place and what are the risks I am having by disabling.

2

Source: https://webmasters.stackexchange.com/a/477/20604

It's important to keep a few things in mind when using FTP - it is not encrypted by default meaning your credentials and content that you send are sent in the clear so are vulnerable to interception. To address this you should connect to your hosting provider using FTPS (FTP over SSL/TLS).


Source: SFTP, FTPS and SecureFTP differences and security implications

There are 3 different protocols commonly used for transfering files over the Internet, and they are commonly confused between.

  • FTPS - an extension to the FTP protocol to support using FTP over SSL/TLS. This is typically based on a client-requested negotiation, and there are specific FTP commands to request/enforce/implement the encryption using SSL.

  • FTP over SSH (commonly called SecureFTP) - tunneling standard FTP over a SSH connection. Take into account that it is a bit more complicated to force the data channels to continue tunneling over SSH, even if the control channel is tunnelled.

  • SFTP - This is a completely different protocol, SSH File Transfer Protocol. This is not related to FTP, but is a completely different protocol. SFTP is actually a sub-protocol from the SSH protocol suite, i.e. a SSH extension (however I understand that it can be used seperately, too).

Advantage of FTPS is that it is similar to HTTPS - same type of certificate, etc. Many webservers support FTPS natively, and thus it is often "simpler" to set up and have admins up to speed faster.
SFTP has advantage in *nix shops, that are typically already more SSH-friendly - if they already set up a public SSH server securely, its pretty simple to add SFTP functionality.

Note that SecureFTP (FTP over SSH) is NOT trivial in any case (even if you already have the SSH set up), and I haven't seen it in use by security-conscious orgs (that's not to say it CAN'T be, but isn't commonly).

4
  • what you mean my credentials? it is too risky! and who can do this interception? what are the tools needed? – ruben Mar 16 '15 at 0:11
  • 1
    Can be intercepted various ways from sniffing packets. You're need to Google it because its far to much to explain in an answer never mind a comment field. Your best of fixing the issue and using SFTP for security reasons... Band aids will only work for so long. – Simon Hayter Mar 16 '15 at 0:16
  • I have talked with the hosting site, they say they are ok with TLS, then I think it is my ISP that is blocking TLS – ruben Mar 16 '15 at 0:20
  • 1
    I've added abit more information about the various of types of FTP for you. – Simon Hayter Mar 16 '15 at 0:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.