FTP security
FTPS is not SFTP
Distinguish FTP over TLS from the SSH File Transfer Protocol and choose configuration vocabulary precisely.
8 minute lesson
FTPS preserves FTP commands, replies, and separate data connections, then protects them with TLS.
SFTP is the SSH File Transfer Protocol. It runs as an SSH subsystem, commonly over one SSH connection on port 22. It does not use FTP commands, active mode, or passive mode.
A hosting dashboard that asks for SFTP credentials is not asking you to enable FTPS. Match the client mode to the server protocol; similar names do not make them interchangeable.
Compare the connection models:
FTPS: control TLS connection + separate TLS data connections
SFTP: SSH connection + SFTP subsystem messages in that connectionFTPS authenticates the server with a TLS certificate. SFTP normally authenticates the SSH host key. Ignoring either identity check makes encryption vulnerable to connecting to the wrong machine.
Passive port ranges, PASV, EPSV, and PROT P belong to FTPS. SSH keys, host-key fingerprints, and subsystem configuration belong to SFTP. Port 990 may be used for implicit FTPS, while port 22 commonly serves SSH/SFTP; neither port is proof of the protocol.
Operational requirements can decide the choice. A partner may require FTPS for an established gateway. A server team may prefer SFTP because one SSH connection is simpler through firewalls.
Take a client configuration and classify every setting as FTP/FTPS, SFTP/SSH, or shared. Remove any setting copied from the wrong protocol.
Lesson completed