Does .NET FtpWebRequest Support both Implicit (FTPS) and explicit (FTPES)?

Question

I am being asked to support implicit and explicit FTPS (also known as FTPES). We are currently using the .NET FtpWebRequest. Does the FtpWebRequest support both types of FTPES, and what is the difference?

Thanks

Phrygian

Answer 1

as far as I know the current (.NET 2.0 and 3.5) version of FtpWebRequest supports Explicit SSL only.

Actually, .NET 2.0 does not currently support implicit SSL, only explicit. We will consider adding this for a future release.

JonCole - MSFTModerator at MSDN forum post

If you need to use both Implict and Explicit TLS/SSL you have to try one of third-party FTP/SSL components. Following code uses our Rebex FTP/SSL and is taken from the tutorial page.

Explicit TLS/SSL

Client connects to FTP server in a usual non-protected way, usually to port 21 was assigned to FTP protocol. When it is desired to protect the connection using SSL, an SSL negotiation is initialized, control connection is secured and all following communication is being protected.

// Create an instance of the Ftp class. 
Ftp ftp = new Ftp();

// Connect securely using explicit SSL. 
// Use the third argument to specify additional SSL parameters. 
ftp.Connect(hostname, 21, null, FtpSecurity.Explicit);

// Connection is protected now, we can log in safely. 
ftp.Login(username, password);

Explicit protection means that it is possible to secure the connection at any moment. If you don't know whether you will need the protection on not at the connection time, you might want to connect using the ordinary unencrypted FTP protocol and secure the connection later.

Ftp ftp = new Ftp();

// Connect to the server with no protection. 
ftp.Connect(hostname, 21);

// Upgrade connection to SSL. 
// This method also accepts an argument to specify SSL parameters. 
ftp.Secure();

// Connection is protected now, we can log in safely. 
ftp.Login(username, password);

Implicit SSL protection of the FTP session

FTPS protocol was originally assigned a separate port by the IANA. Upon connection to this port, an SSL negotiation starts immediately and the control connection is secured. All data connections are also secured implicitly in the same way. This is similar to the approach used by HTTPS.

This approach is not favored by the IETF and is deprecated. It is supported by Rebex FTP/SSL for interoperability with older servers, but it is strongly recommended to use the explicit protection instead whenever possible.

Ftp ftp = new Ftp();

// Connect securely using implicit SSL. 
// Use the third argument to specify additional SSL parameters. 
ftp.Connect(hostname, 990, null, FtpSecurity.Implicit);

// Connection is protected now, we can log in safely. 
ftp.Login(username, password);

You may download the component at rebex.net/ftp-ssl.net/

Jurisconsult

I appreciate the post, although seems like a conflict of interest...since you represent the component you are pushing. – Phrygian

I understand your concern. However it looks like the current consensus here is that mentioning own product is ethically OK as long as full disclosure is provided. I've even changed my nickname to be sure that my bias will not be overlooked ;-). You may find interesting following links at meta.stackoverflow discussing this topic: meta.stackexchange.com/questions/15787/… and meta.stackexchange.com/questions/20031/vendors-on-stackoverflow. I think it's ok as long as answer is valid and identity is not hidden. – Jurisconsult

Answer 2

I have used Alex FTPS Client earlier. May be you should look to http://ftps.codeplex.com/.

Temple

+1 for AlexFTPS! LGPL and free (as in $$$) which is what a core library like this should be. Why MS didn't support implicit TLS/SSL in their built-in FTP classes, I'll never know. – Participial

@mattmc3, I know why MS didn't build Implicit SSL; it is because it is deprecated. – Saurischian

AlexFTPS is now a NuGet package as well. – Synonymy

Answer 3

.NET Framework/FtpWebRequest supports only explicit TLS/SSL encryption. It does not support implicit TLS/SSL encryption.

I believe it's unlikely it ever will. The FTP implementation of .NET frameworks uses only standardized features of the protocol. The implicit TLS/SSL encryption was never standardized. It was introduced only as a temporary mechanism to allow using seamless encryption with FTP clients that did not support encryption. In general, there's no reason to use implicit TLS/SSL encryption. An FTP server that supports implicit TLS/SSL encryption only, is broken, imo. Note that RFC 2228 [FTP Security Extensions] was introduced over 20 years ago!

---

Anyway, if you need to use the implicit TLS/SSL encryption, you have to use a 3rd party FTP library.

With WinSCP .NET assembly, it's easy:

// Set up session options
SessionOptions sessionOptions = new SessionOptions
{
    Protocol = Protocol.Ftp,
    UserName = "username",
    Password = "password",
    FtpSecure = FtpSecure.Implicit,
};

using (Session session = new Session())
{
    // Connect
    session.Open(sessionOptions);

    // Your code
}

You can have WinSCP GUI generate a C# FTP code template, like the one above, for you.

(I'm the author of WinSCP)

Uncap

Answer 4

You can also try Ftp.dll FTP/FTPS client.

It supports implicit and explicit SSL connections. Here's the implicit sample:

using(Ftp ftp = new Ftp())
{
    ftp.ConnectSSL("ftp.server.com");

    ftp.Login("user", "password");

    ftp.ChangeFolder("uploads");
    ftp.UploadFile("report.txt", @"c:\report.txt");

    ftp.Close();
}

Please note that this is commercial product and I'm the author of this component.

Ayana

Answer 5

edtFTPnet/PRO is an FTP client library that also supports FTPS implicit and explicit modes. It's simply a matter of specifying the right protocol:

 SecureFTPConnection conn = new SecureFTPConnection();
 conn.Protocol = FileTransferProtocol.FTPSImplicit;

 // set remote host, user, pwd etc ...

 // now connect
 conn.Connect();

The same component supports SFTP also.

And yes, I am one of the developers of this component (and of edtFTPnet, the free, open source .NET FTP client).

Raddie

Just to be clear, the product page seems to indicate that the "free" version doesn't support this functionality. Not that you explicitly said it did necessarily, but it's certainly an assumption I made based on your post. – Participial

the free version (LGPL) is FTP only - it does not support FTPS or SFTP – Raddie

Answer 6

Using FTP over implicit SSL is not quite as straightforward, but it can be done in .NET without the use of any 3rd party library. Since implicit SSL is basically FTP commands done over an SSL connection we just need to setup an SSL connection with .NET, then issue the commands we need to download the file.

// Open a connection to the server over port 990
// (default port for FTP over implicit SSL)
using (TcpClient client = new TcpClient("localhost", 990))
using (SslStream sslStream = new SslStream(client.GetStream(), true))
{
    // Start SSL/TLS Handshake
    sslStream.AuthenticateAsClient("localhost");


    // Setup a delegate for writing FTP commands to the SSL stream.
    Action WriteCommand = delegate(string command)
    {
        var commandBytes = Encoding.ASCII.GetBytes(command + Environment.NewLine);
        sslStream.Write(commandBytes, 0, commandBytes.Length);
    };


    // Write raw FTP commands to the SSL stream.
    WriteCommand("USER username");
    WriteCommand("PASS ***p@ssw0rd***"); 

    // Connect to data port to download the file.
}

Phenology

Tried this, not easy if you're not a FTP guru... – Eshman