FTP PROTOCOL
In the Internet, as well as in other networks, communication between people and devices takes place by means of protocols. It is as if they established the rules of communication: who should send certain information and when? What happens if the data does not reach the recipient? How is transmission protected from disturbances and interference? Therefore, whenever we surf the Internet, protocols of the ISO/OSI model are used. The best known are HTTP and HTTPS, which are the protocols we usually use to call up websites. Another important protocol is FTP. But what is it used for?
WHAT IS THE FILE TRANSFER PROTOCOL USED FOR?
File Transfer Protocol (FTP) is one of the oldest protocols on the Internet. As early as 1974, work began with complete file transmission technology. In 1985, FTP was defined precisely in the Request For Comments 959 document. The protocol is designed for the execution of download and upload commands, so as to be able to transmit files from your device (PC, smartphone, etc.) to a server and vice versa. Also with FTP you can download files from a server to your device. The user thus has a file management system that is also recognized by their operating system. The files can be placed inside folders, which in turn can be contained in other folders, thus creating a hierarchical structure of directories. The File Transfer Protocol is often used in the creation of websites. Through FTP access, it is possible to transmit HTML files to a server. Similarly, again thanks to FTP, website managers can make multimedia files accessible to their users. File Transfer Protocol (FTP), in computer science and telecommunications, is an application layer protocol for transmitting data between hosts based on TCP and with a client-server architecture. The protocol uses separate TCP connections to transfer data and to control transfers and requires client authentication via username and password, although the server can be configured for anonymous connections with dummy credentials. Since FTP transmits both these credentials and any other communication in clear text, and since it does not have server authentication mechanisms at the client, the protocol is often secured using an SSL / TLS substrate and this variant is called FTPS.
HOW DOES FTP WORK?
The File Transfer Protocol runs within the application layer of the TCP / IP stack, that is, in the same layer as HTTP or POP. These protocols are characterized by their operation in combination with programs, such as browsers or e-mail clients, thanks to which they perform their function. Also for the File Transfer Protocol there are dedicated FTP software. Normally these programs have two components: one that serves to show the local directory structure with all the files contained on the hard drive, and the other that shows the server memory with related files and folders. The software allows the user to move files from one virtual memory to another, in both directions. Virtually even browsers and the command line of the operating system can be used thanks to FTP. Two channels are opened to establish an FTP connection. First, client and server create a control channel via port 21, through which the client sends commands to the server and it responds with status codes. Then both can create a data channel that carries the desired files from one side to the other. The protocol checks for errors. In the event that a connection is interrupted during the transfer, file transport can resume as soon as contact is re-established. However, a distinction must be made between active and passive FTP. In the active variant, the client establishes the connection, as explained, through port 21 and communicates to the server on which port on the client side it can send its response. But if the client is protected by a firewall, then the server will not be able to send any response as all external connections are blocked. Precisely for these cases, a passive mode has been developed, which requires the server to make known the port through which the client can create the data channel. In this way, since the client initiates the connection, the firewall does not block the data transfer. The File Transfer Protocol has various commands and status codes. Thanks to 32 total commands – not always necessarily all implemented by the server – the client instructs the server on what is the desired operation: upload or download files, organize folders, or delete files. The server responds each time with a status code which serves to inform whether the command can be executed successfully or not. Access data is usually required in order to use FTP on a server, but there is also the possibility that a server offers anonymous FTP. In the latter case, the server administrator allows each user to move or download files to the server via FTP, without needing a password. However, open FTP servers run security risks, which is why there are limits on users. In an active data channel, the client opens a usually random port, through the command channel it makes known the number of this port to the server and waits for it to connect. Once the server has activated the data connection to the FTP client, the latter binds the source port to port 20 of the FTP server. The PORT or EPRT commands can be used for this, depending on the network protocol used (usually IPv4 or IPv6). In a passive data channel the server opens a usually random port (higher than 1023), through the command channel it makes known the number of this port to the client and waits for it to connect. For this purpose, the PASV or EPSV commands can be used, depending on the network protocol used (usually IPv4 or IPv6). Both the command channel and the data channel are TCP connections; FTP creates a new data channel for each file transferred within the user session, while the command channel remains open for the entire duration of the user session, in other words the command channel is persistent while the data channel is non-persistent. An FTP server offers several functions that allow the client to interact with its filesystem and the files that populate it, including:
File download / upload.
Resume of interrupted transfers.
Removing and renaming files.
Directory creation.
Directory browsing.
FTP COMMAND LIST
OPERATING DIAGRAM
Where is it:
PI (protocol interpreter) is the protocol interpreter, used by client (User-PI) and server (Server-PI) for the exchange of commands and responses. In common parlance this is referred to as the “command channel”.
DTP (data transfer process) is the data transfer process, used by client (User-DTP) and server (Server-DTP) for data exchange. In common parlance, it is referred to as a “data channel”.
RESPONSE CODES
- 1xx: Preliminary positive answer. The requested action has begun but there will be another response indicating that it is indeed completed
- 2xx: Final positive answer. The requested action is completed. The client can now send other commands.
- 3xx: Intermediate positive response. The command has been accepted but a second one must be sent for the request to be definitively completed.
- 4xx: Temporary negative response. The command failed but may work later.
- 5xx: Final negative answer. The command failed and the client should no longer repeat it.
- x0x: Syntax error.
- x1x: Response to an information request.
- x2x: Connection related response.
- x3x: Account and / or permissions response.
- x4x: Not better specified.
- x5x: File-system related response.
SECURITY WITH THE FTP PROTOCOL
The original File Transfer Protocol was created without prior security measures. At the time, the Internet was still very small and cybercrime did not yet exist. But over time, the security risks associated with the use of FTP have become numerous, as the information transmitted has not been previously encrypted. Therefore, two secure variants were developed, which have continued to compete with each other ever since: FTPS and SFTP. The first variant is FTP over SSL. The connection is established using the Secure Socket Layers (SSL), that is the Transport Layer Security (TLS), which serves to encrypt the data exchange. The SSH File Transfer Protocol (SFTP), on the other hand, uses the Secure Shell (SSH) to ensure secure data transmission. Again the connection is encrypted. But while FTPS requires two connections, SFTP only needs one. On the other hand, you have to use an additional program.
Leave A Comment