FTP over SSH (not SFTP)

FTP over SSH (not SFTP) refers to the practice of tunneling a normal FTP session over an SSH connection.

Because FTP uses multiple TCP connections (unusual for a TCP/IP protocol that is still in use), it is particularly difficult to tunnel over SSH. With many SSH clients, attempting to set up a tunnel for the control channel (the initial client-to-server connection on port 21) will protect only that channel; when data is transferred, the FTP software at either end will set up new TCP connections (data channels) which will bypass the SSH connection, and thus have no confidentiality, integrity protection, etc.

Otherwise, it is necessary for the SSH client software to have specific knowledge of the FTP protocol, and monitor and rewrite FTP control channel messages and autonomously open new forwardings for FTP data channels. Version 3 of SSH Communications Security's software suite, and the GPL licensed FONC are two software packages that support this mode.

FTP over SSH is sometimes referred to as secure FTP; this should not be confused with other methods of securing FTP, such as with SSL/TLS (FTPS). Other methods of transferring files using SSH that are not related to FTP include SFTP and SCP; in each of these, the entire conversation (credentials and data) is always protected by the SSH protocol.


Red Drive is a free file transfer extension that integrates with your Windows Explorer environment allowing you to drag, drop, open and edit files on remote servers without launching a separate file transfer client. Red Drive supports various file transfer protocols including FTP, FTPS (FTP over SSL), SFTP (FTP over SSH) and WebDAV.

SSH Port Forwarding

SSH is typically used for logging into remote servers so you have shell access to do maintenance, read your email, restart services, or whatever administration you require. SSH also offers some other native services, such as file copy (using scp and sftp) and remote command execution (using ssh with a command on the command line after the hostname).

Whenever we SSH from one machine to another, we establish a secure encrypted session. This first article in this SSH series at properly verifying a server's host key, so that we can be sure that no attacker is able to perform a man-in-the-middle attack and gain access to read or manipulate what we do in that session. Other articles in this series looked at removing the need for static passwords using SSH user identities, and then using ssh-agent to automate the task of typing passphrases.

SSH also has a wonderful feature called SSH Port Forwarding, sometimes called SSH Tunneling, which allows you to establish a secure SSH session and then tunnel arbitrary TCP connections through it. Tunnels can be created at any time, with almost no effort and no programming, which makes them very appealing. In this article we look at SSH Port Forwarding in detail, as it is a very useful but often misunderstood technology. SSH Port Forwarding can be used for secure communications in a myriad of different ways.

SSH Tunnel Diagram

Hand drawn Diagram about SSH tunneling

Simple File Transfer Protocol

Simple File Transfer Protocol, as defined by RFC 913, was proposed as an (unsecured) file transfer protocol with a level of complexity intermediate between TFTP and FTP.

It was never widely accepted on the Internet, and is now assigned Historic status by the IETF.

It is sometimes confused with SSH file transfer protocol, a secured file transfer protocol.

It runs through port 115, and often receives the acronym of SFTP. It has a command set of 11 commands and support three types of data transmission: ASCII, BINARY and CONTINUOUS. For systems which have "WORD SIZE" which are multiples of 8 bits, the implementation of BINARY and CONTINUOUS is the same.

The protocol supports the following:

1. User id based login (User-id/Password combination)
2. Hierarchical folders
3. File Management (Rename, Delete, Upload, Download, Download with overwrite, Download with append)

The protocol does not support random access inside a file (required for resuming interrupted transfers).

SFTP may refer to:

Relating to file transfer:

* SSH file transfer protocol, a network protocol designed by the IETF to provide secure file transfer and manipulation facilities over the secure shell (SSH) protocol. This is typically meant in context of file transfer.
* FTP over SSH, the practice of running an FTP session over SSH, sometimes called Secure FTP. Rarely used, because FTP's normal 2-channel nature makes such tunneling hard.
* Simple File Transfer Protocol, an unsecured and rarely-used file transfer protocol from the early days of the Internet.
* Serial File Transfer Protocol, a protocol used to transfer files between a PC and an embedded device using RS-232 or similar serial protocols.

SFTP may also refer to:

* Screened fully-shielded twisted pair, a kind of network cable, in contrast to FTP and STP
* Science for the People, a U.S. left-wing organization and magazine
* Six Flags Theme Parks, chain of amusement parks and theme parks.

List of FTP server return codes

Code	Explanation
100	Series: The requested action is being initiated, expect another reply before proceeding with a new command.
110	Restart marker replay . In this case, the text is exact and not left to the particular implementation; it must read: MARK yyyy = mmmm where yyyy is User-process data stream marker, and mmmm server's equivalent marker (note the spaces between markers and "=").
120	Service ready in nnn minutes.
125	Data connection already open; transfer starting.
150	File status okay; about to open data connection.
200	Command okay.
202	Command not implemented, superfluous at this site.
211	System status, or system help reply.
212	Directory status.
213	File status.
214	Help message.On how to use the server or the meaning of a particular non-standard command. This reply is useful only to the human user.
215	NAME system type. Where NAME is an official system name from the list in the Assigned Numbers document.
220	Service ready for new user.
221	Service closing control connection.
225	Data connection open; no transfer in progress.
226	Closing data connection. Requested file action successful (for example, file transfer or file abort).
227	Entering Passive Mode (h1,h2,h3,h4,p1,p2).
228	Entering Long Passive Mode (long address, port).
229	Entering Extended Passive Mode (|||port|).
230	User logged in, proceed. Logged out if appropriate.
231	User logged out; service terminated.
232	Logout command noted, will complete when transfer done.
250	Requested file action okay, completed.
257	"PATHNAME" created.
331	User name okay, need password.
332	Need account for login.
350	Requested file action pending further information
421	Service not available, closing control connection. This may be a reply to any command if the service knows it must shut down.
425	Can't open data connection.
426	Connection closed; transfer aborted.
434	Requested host unavailable.
450	Requested file action not taken.
451	Requested action aborted. Local error in processing.
452	Requested action not taken. Insufficient storage space in system.File unavailable (e.g., file busy).
500	Syntax error, command unrecognized. This may include errors such as command line too long.
501	Syntax error in parameters or arguments.
502	Command not implemented.
503	Bad sequence of commands.
504	Command not implemented for that parameter.
530	Not logged in.
532	Need account for storing files.
550	Requested action not taken. File unavailable (e.g., file not found, no access).
551	Requested action aborted. Page type unknown.
552	Requested file action aborted. Exceeded storage allocation (for current directory or dataset).
553	Requested action not taken. File name not allowed.

List of file transfer protocols

Primarily used with TCP/IP

* Apple Filing Protocol (AFP)
* FTAM
* FTP
* FTPS
* HTTP
* HTTPS
* rcp
* SSH file transfer protocol (SFTP)
* Secure copy (SCP)
* Simple File Transfer Protocol
* rsync

Primarily used with UDP

* Trivial File Transfer Protocol
* File Service Protocol
* UFTP – UDP Based FTP with Multicast
* Multicast File Transfer Protocol
* Tsunami

Primarily used with direct modem connections

* ASCII dump
* BiModem
* CModem
* Compuserve B (aka B protocol or CIS-B)
* JMODEM
* HMODEM
* HSLINK
* HyperProtocol

* Kermit and variants:
o Kermit
o SuperKermit

* LeechModem
* Lynx (protocol)
* MEGAlink (protocol)
* MPt (Puma)
* NMODEM
* Punter family

* SEAlink
* SuperK
* TELINK
* Tmodem

* UUCP and variants:
o UUCP
o UUCP-g

* XMODEM and variants:
o MODEM7 (Batch XMODEM)
o XMODEM, XMODEM-1K, XMODEM-G
o WXMODEM

* YMODEM and variants:
o YMODEM, YMODEM-1K, YMODEM-G

* ZMax
* ZMODEM

FTP over SSH

FTP over SSH refers to the practice of tunneling a normal FTP session over an SSH connection.

Because FTP uses multiple TCP connections (unusual for a TCP/IP protocol that is still in use), it is particularly difficult to tunnel over SSH. With many SSH clients, attempting to set up a tunnel for the control channel (the initial client-to-server connection on port 21) will protect only that channel; when data is transferred, the FTP software at either end will set up new TCP connections (data channels) which will bypass the SSH connection, and thus have no confidentiality, integrity protection, etc.

If the FTP client is configured to use passive mode and to connect to a SOCKS server interface that many SSH clients can present for tunneling, it is possible to run all the FTP channels over the SSH connection.

Otherwise, it is necessary for the SSH client software to have specific knowledge of the FTP protocol, and monitor and rewrite FTP control channel messages and autonomously open new forwardings for FTP data channels. Version 3 of SSH Communications Security's software suite, and the GPL licensed FONC are two software packages that support this mode.

FTP over SSH is sometimes referred to as secure FTP; this should not be confused with other methods of securing FTP, such as with SSL/TLS (FTPS). Other methods of transferring files using SSH that are not related to FTP include SFTP and SCP; in each of these, the entire conversation (credentials and data) is always protected by the SSH protocol.