Choosing Between FTP over TLS (Explicit) and SFTP in FileZilla: A Practical Decision Guide

Decision Context

When configuring FileZilla’s Site Manager for secure file transfers, you must decide between FTP over TLS (Explicit) and SFTP (SSH File Transfer Protocol). Both provide encryption, but they differ in protocol design, port usage, and firewall requirements.

The key decision points are:

• Existing server capabilities (does the server support FTP‑TLS or only SFTP?)
• Network security posture (how many ports can you open?)
• Authentication preferences (password vs. public‑key)
• Administrative overhead (port configuration, firewall rules, key management)

Options Comparison

Feature	FTP over TLS (Explicit)	SFTP (SSH)
Protocol Layer	FTP upgraded to TLS via AUTH TLS	SSH‑based, single encrypted channel
Default Ports	Control: 21, Data: dynamic passive range (default 1024‑65535)	22 (single port)
Firewall Complexity	Requires opening control port and passive range; NAT traversal can be tricky	Only port 22 needs to be open; NAT traversal is straightforward
Authentication	Password, certificate, or client‑side key via TLS handshake	Password or public‑key (private key stored locally)
Server Compatibility	Any FTP server that implements TLS (e.g., vsftpd, ProFTPD)	Any SSH‑enabled server (e.g., OpenSSH, Dropbear)
Performance	Two separate connections (control/data) can add overhead	Single connection reduces handshake overhead
Deprecation Risk	Implicit TLS is deprecated; explicit is widely supported	SSH is actively maintained

Trade‑Off Analysis

• Port Footprint: If your network allows only a handful of open ports, SFTP’s single port is preferable. FTP‑TLS can still be used if you can open a passive port range but may require additional firewall rules.
• Server Constraints: Many legacy systems support only FTP‑TLS. If your server is strictly SSH‑based, SFTP is the only option.
• Key Management: SFTP’s public‑key mechanism is robust for automated scripts and eliminates the need for password resets. FTP‑TLS can also use client certificates, but key management is less common.
• Firewall NAT Scenarios: In NAT environments, SFTP’s single port is easier to proxy. FTP‑TLS may need a proxy that understands passive mode and can translate dynamic data ports.
• Performance & Latency: For high‑volume transfers, the single encrypted channel of SFTP typically offers lower latency than the dual‑channel FTP‑TLS.

Concrete Implementation Example

1. Create an FTP over TLS (Explicit) Site

1. Open FileZilla → File → Site Manager.
2. Click New Site and name it MyFTP_TLS.
3. Set Protocol to FTP - File Transfer Protocol.
4. Set Encryption to Require explicit FTP over TLS.
5. Enter the server hostname (e.g., ftp.example.com) and port 21.
6. Under Logon Type, choose Normal and provide username/password.
7. Under Transfer Settings, check Passive mode to ensure the client requests a passive data port.
8. Click Connect and observe the message log. A successful handshake will show AUTH TLS and 200 responses.

2. Create an SFTP Site with Public‑Key Authentication

1. In Site Manager, click New Site and name it MySFTP_Key.
2. Set Protocol to SFTP - SSH File Transfer Protocol.
3. Enter the server hostname (e.g., sftp.example.com) and port 22.
4. Under Logon Type, choose Key file.
5. Provide the path to your private key file (e.g., C:\Users\me\.ssh\id_rsa). FileZilla accepts OpenSSH format; if you have a PuTTY format, convert it with puttygen.
6. Optionally set a passphrase if your key is encrypted.
7. Click Connect. The log should show SSH-2.0-OpenSSH_8.4 handshake and Authenticated status.

3. Validation Checklist

• Connection Log: Verify that the protocol negotiation messages appear (e.g., AUTH TLS for FTP‑TLS, SSH-2.0 for SFTP).
• Data Transfer: Upload a small test file and confirm it appears on the server.
• Firewall Test: If possible, block the passive data port range and confirm FTP‑TLS fails while SFTP succeeds.
• Key Rotation: For SFTP, rotate the key on the server and ensure FileZilla still authenticates.

Limitations and Caveats

• FTP over TLS does not support client certificate authentication out of the box in FileZilla; you must use password or server‑side certificate validation.
• Passive mode may still fail if the server’s passive port range is incorrectly configured or blocked by an upstream firewall.
• Public‑key authentication requires the server to be configured with the corresponding public key; FileZilla cannot generate or upload keys for you.
• Implicit FTP‑TLS is not recommended and is not shown in FileZilla’s protocol list.

Decision Summary

Choose FTP over TLS (Explicit) if:

• You must use an existing FTP server that only supports TLS upgrades.
• You can manage a passive data port range in your firewall.
• You prefer password or TLS certificate authentication.

Choose SFTP if:

• Your server is SSH‑based or you can install an SSH daemon.
• You want a single port solution that simplifies firewall rules.
• Public‑key authentication is desirable for automated workflows.

By following the configuration steps above and validating the connection logs, you can ensure the chosen protocol meets your security and operational requirements.