FTPES

FTPES, or FTP over Explicit TLS/SSL, is a mode of FTPS where the control connection is upgraded to TLS after connecting. Clients connect to the standard FTP port 21 and issue the AUTH TLS command to begin a TLS handshake. Once the TLS session is established, subsequent control commands, including authentication, are transmitted over the encrypted channel.

For protecting the data channel, FTPES uses the FTP security extensions PBSZ and PROT (see RFC 4217). The client typically issues PBSZ 0 to create a protection buffer, and then PROT P to enable encryption for the data channel. If PROT P is not used, the data channel may remain unencrypted. Data transfer connections can be established in passive or active mode as with standard FTP, and encryption applies to the data channel when enabled.

Differences from implicit FTPS: In implicit FTPS, TLS begins immediately upon connecting, usually on port 990 for the control connection, whereas FTPES uses a plain connection on port 21 that is upgraded. Implicit FTPS has simpler firewall traversal but less flexible, while FTPES offers more negotiation options but can be more challenging to pass through firewalls and proxies.

Security and compatibility: FTPES provides encryption for credentials and data, but requires both client and server to support TLS negotiation and the FTPS extension commands. It is distinct from SFTP (SSH-based). FTPES is defined in RFC 4217 and is supported by many FTP servers and clients, though deployment varies across environments.