FTP in Practice | Active & Passive Modes· FTPS

FTP in Practice | Active & Passive Modes· FTPS

· 16분 읽기 · 수정 Beginner Guide
FTP in Practice | Active & Passive Modes· FTPS

이 글의 핵심

FTP control and data channels, Active vs Passive, FTPS and SFTP compared, firewall and NAT issues—beginner operations guide to file transfer.

Introduction

FTP (File Transfer Protocol) has been used since the 1970s for file exchange—still common in batch jobs, legacy systems, industrial gear, and large MFT workflows. It splits control and data channels and uses Active vs Passive modes, so firewall rules differ—often the source of “works locally, fails in prod.” By 2026, plaintext credentials make FTPS or SFTP the norm for anything security-sensitive. This article explains behavior, client/server configuration, and how to choose among FTP, FTPS, and SFTP.

After reading this post

  • Separate control (21/tcp) from data channels
  • Explain Active vs Passive and firewall/NAT impact
  • Use CLI and GUI clients for upload, download, and resume
  • Choose FTPS vs SFTP on security and ops grounds

Table of contents

  1. Protocol overview
  2. How it works
  3. Hands-on usage
  4. Security considerations
  5. Real-world use cases
  6. Optimization tips
  7. Common problems
  8. Wrap-up

Protocol overview

History and background

FTP dates to RFC 114 (1971); RFC 959 (1985) is the classic reference, later extended for IPv6, security (FTPS), and more. HTTP, S3, and cloud APIs displaced FTP for new greenfield systems, but mainframes, plant equipment, and legacy MFT still expose FTP.

OSI placement

FTP is an application-layer protocol over TCP (control 21, data varies by mode). SFTP is not FTP—it runs over SSH.

Core properties

PropertyDescription
Dual channelCommands on control; file bytes on data.
Stateful sessionLogin, CWD, interactive dialogue.
Transfer modesStream, block, compressed (implementation-dependent).
Text commandsUSER, PASS, RETR, STOR, …

How it works

Control vs data

  • Control (default 21/tcp): Auth, directory changes, transfer setup.
  • Data: Actual LIST output and file payloads.

Active mode

  1. Client opens control to server 21.
  2. For transfer, client advertises a local data port (PORT).
  3. Server initiates data connection to the client (“active” server connect). Often fails behind client firewalls that block inbound data connections.

Passive mode

  1. Control connection same as above.
  2. Client sends PASV (or EPSV) and receives server IP:port for data.
  3. Client connects outbound to the server’s data port. Server must allow the passive port range in the firewall.
sequenceDiagram
  participant C as Client
  participant S as Server
  C->>S: Control connection
  C->>S: PASV
  S->>C: Data address and port
  C->>S: Data connection
  S->>C: File transfer

Common commands (conceptual)

CommandMeaning
USER / PASSLogin (plaintext—risky).
PWD / CWDPath and cd.
LIST / NLSTDirectory listing.
RETRDownload.
STOR / APPEUpload / append.
TYPEASCII vs IMAGE (binary).
PASV / EPSVPassive mode.

Hands-on usage

CLI client (lftp example)

Option names vary—check lftp docs and set -a.

lftp -u username,password ftp.example.com
curl -u user:pass 'ftp://ftp.example.com/pub/readme.txt' -o readme.txt

vsftpd sketch (concept)

/etc/vsftpd.conf (paths vary by distro)

listen=YES
anonymous_enable=NO
local_enable=YES
write_enable=YES
local_umask=022
pasv_enable=YES
pasv_min_port=50000
pasv_max_port=50100
# pasv_address=PUBLIC_IP   # important behind NAT
ssl_enable=YES             # FTPS

Open 21/tcp and pasv_min–max in the firewall for stable Passive.

Chroot and permissions

  • Dedicated system accounts and chroot to limit writable roots.
  • Minimum permissions on upload directories.

Security considerations

Plain FTP risks

Credentials and payloads can be sniffed on untrusted networks.

FTPS (FTP over TLS)

Explicit FTPS: AUTH TLS on the control channel, then encrypt. Avoid legacy implicit 990 when possible. Keep TLS versions and certificates current.

SFTP (over SSH)

SFTP is not FTP. It runs inside SSH, with keys and encryption as first-class. Greenfield often picks SFTP.

AspectFTPSSFTP
BaseFTP + TLSSSH
Ports21 + data range (complex)22 (simpler)
Legacy toolsClassic FTP clientsSSH clients

Real-world use cases

ScenarioNotes
Legacy integrationBanks, manufacturing batch exchanges, old MFT.
Large filesClients with resume and parallel (lftp mirror).
Anonymous mirrorsPublic FTP—needs abuse controls.
Device firmwareSome devices only expose FTP—isolate networks and prefer FTPS.

Optimization tips

  • Parallel transfers: lftp mirror -P N for many files.
  • Resume: verify REST/RETR or client resume support.
  • Binary mode: use TYPE I for images and zip to avoid corruption.
  • Placement: reduce RTT with nearby relay servers.

Common problems

SymptomCheck
Passive timeoutsOpen PASV range on server firewall; set pasv_address behind NAT.
Active fails onlyClient inbound data ports blocked—switch to Passive.
Listing works, transfer failsData channel firewall or FTPS data channel TLS settings mismatch.
Mojibake filenamesClient UTF-8, server OPTS UTF8 ON support.

Wrap-up

FTP’s split channels and Active/Passive behavior interact tightly with firewalls and NAT, while plaintext is a legacy liability. FTPS hardens transport; SFTP or object APIs are the modern direction. Use this article for legacy FTP maintenance, Passive/NAT debugging, and roadmaps toward FTPS/SFTP.

References

  • RFC 959, RFC 4217 (FTPS)
  • man lftp, OpenSSH SFTP documentation

자주 묻는 질문 (FAQ)

Q. 이 내용을 실무에서 언제 쓰나요?

A. FTP control and data channels, Active vs Passive, FTPS and SFTP compared, firewall and NAT issues—beginner operations.

Q. 선행으로 읽으면 좋은 글은?

A. 각 글 하단의 이전 글 또는 관련 글 링크를 따라가면 순서대로 배울 수 있습니다. C++ 시리즈 목차에서 전체 흐름을 확인할 수 있습니다.

Q. 더 깊이 공부하려면?

A. cppreference와 해당 라이브러리 공식 문서를 참고하세요. 글 말미의 참고 자료 링크도 활용하면 좋습니다.

같이 보면 좋은 글 (내부 링크)

이 주제와 연결되는 다른 글입니다.

이 글에서 다루는 키워드 (관련 검색어)

Network, FTP, FTPS, SFTP, File Transfer, Active, Passive 등으로 검색하시면 이 글이 도움이 됩니다.