FTP allows users to transfer files between systems reliably and efficiently through a single protocol using two channels - the command channel on port 21 handles authentication and commands while the data channel on a temporary high port handles the transfer of files and directory listings; however, FTP transmits all data like usernames, passwords and file contents in plain text, making it insecure over public networks. Firewalls must allow outbound connections from clients on port 21 and the server's defined passive port range, along with inbound connections to the server on its passive ports.

1. FTP
An overview of what FTP is and how it works

2. The goal of FTP
The FTP specification states that the protocol sets out to achieve the following goals:
● Provide a layer of abstraction that allows users to interface with different file systems through a
single protocol
● Encourage implicit use of remote computers
● To transfer data reliably and efficiently
● To promote sharing of files by achieving the above

3. Channels

4. The Command channel
The Command channel typically runs on port 21. Its purpose is to accept client connections and handle
the exchange of simple command between client and server. Example commands sent on this channel
would be USER and PASS, which are sent from the client in order to authenticate the user.
While an FTP connection is open, the command channel is too. The channel only closes once the user
disconnects by sending the QUIT command, or the server forcibly terminates the connection.

5. The Data Channel
The data channel is used for exchanging data such as directory listings, file uploads and file downloads
(LIST, STOR, RETR commands). The channel is only open while data is being sent and is closed as soon as
the transfer is complete. Data channels are opened up on temporary ports.
Multiple, concurrent transfers can take place by the way of multiple data channels listening on multiple
ports at once.
Temporary ports are defined within a passive port range, for example (2000-2500)

6. Security & Firewall

7. Because of this, all of the data exchanged during an FTP session is readable to anybody looking at your traffic.
All data exchanged over FTP is unencrypted!

8. Firewall
Server
● Must allow outbound connections on port 21 (Command channel)
● Define passive port range (e.g 2000-2500) and allow inbound connections
Client
● Must allow outbound connections on port 21 (Command channel)
● Allow outbound connections on passive port range defined by server (Data chanel)