From Wikipedia:
FTPS
Main article: FTPS
Explicit FTPS is an extension to the FTP standard that allows clients to request FTP sessions to be encrypted. This is done by sending the "AUTH TLS" command. The server has the option of allowing or denying connections that do not request TLS. This protocol extension is defined in RFC 4217. Implicit FTPS is an outdated standard for FTP that required the use of a SSL or TLS connection. It was specified to use different ports than plain FTP.
With Explicit you connect to port 21 in the clear and then issue the command AUTH TLS to negotiate a secure connection. Once the connection is secured, your command sent over port 21 are encrypted which includes the user logon. The secondary data channel may be encrypted or not depending on the server configuration.
IE does not support logging in to a FTP site but you can open with Explorer to log in. I do not know if that will allow you to run the AUTH TLS command.
Chris Bipes
Director of Information Services
CrossCheck, Inc.
-----Original Message-----
From: MIDRANGE-L [mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of Rob Berendt
Sent: Thursday, March 31, 2016 8:41 AM
To: midrange-l@xxxxxxxxxxxx
Subject: Plain FTP - Using Encrypted Authentication.
Apparently there are the following:
FTPS (not in use here and no plans)
SFTP
FTP (plain)
FTP (with encrypted authentication)
We're getting a security ding because we still have a few people using
plain ftp without even the encrypted authentication.
Apparently the big concern is that, even if you feel the data being
transferred does not really need to be secured (perhaps you only download
company brochures for example) you should encrypt the user id and password
used to log into the ftp site. And, yes, our site has users other than
anonymous and data other than company brochures.
It's a simple change of the parameter in Go Anywhere to "Force Encrypted
Authentication".
My concern is that will change the behavior of many clients and stop them.
Our biggest exchange is another lpar using plain scripted ftp from IBM i.
Would I have to change that to use SECCNN(*IMPLICIT) on the FTP command?
Do I have to set up something else on the client, like store a certificate
or something or is that just done automatically?
IDK what clients our other partners are using. If, for example, they are
using the PC DOS command line's ftp client, I don't see a parameter on
that ftp command to match SECCNN(*IMPLICIT). If they use a browser for
their ftp client will that handle this?
Some clients may be ok. I think the default on FileZilla is "Use explicit
FTP over TLS if available".
I probably could get us excepted from this ding, but if it can be done
without any disruption I'd like to appear as working with them.
midrange.com
