File Transfer Protocol

• The File Transfer Protocol is the most common method of transferring a file from one computer to another. It is so prevalent that public file servers call themselves "FTP servers." When FTP is in operation on an Internet transaction, the address in the address bar of an applications starts with "ftp://" instead of the well-known "http://." Addresses of file servers and file sites start with "ftp." instead of "www." FTP has three incarnations. The first is as a command line utility, the original format for the application. The FTP code is available as a function library for other programs and several Windows version have been developed.
  
  

FTP Session

• When the user starts an FTP session, the command prompt changes to "ftp>." The environment has its own command set and enables users first to log in to a remote computer. The user account for the FTP session is a pre-existing account on the remote computer. The FTP utility does not have its own independent password protection. Once logged in, the user can move around the directory structure, send or receive files, change the names of files on the remote computer, move them and change their access permissions.
  
  

FTP Procedures

• FTP uses two connections. The first sends the commands and and responses, and so is called the "command connection." File transfers occur over the data connection. The major weakness of FTP is that it does not encrypt either connection. Even when the username and password are sent to the server, they travel in plain text. FTP uses the Transmission Control Protocol to establish connections. It is this protocol with which the Secure Socket Layer integrates to provide session security. SSL was an obvious partner to provide security procedures for FTP. It already existed and integrated well with FTPs connection procedures.
  
  

FTPS

• The employment of SSL for FTP is variously called "FTP over SSL," "FTP Secure" or "FTPS." The specification for FTPS allows negotiation of security at the point of establishing a connection. If one side is not SSL-enabled, the connection can go ahead without SSL. This is called "FTP over explicit SSL," or FTPES. FTP over implicit SSL does not allow for an unsecured option. The connection either uses SSL or it does not happen. Connection establishment opens with key exchange. This version is called "FTP over implicit SSL." SSL was found to have security flaws and so it was replaced by the Transport Layer Security Protocol or TLS. With this, the two versions of FTPS became known as "FTP over explicit TLS" and "FTP over implicit TLS."