Should I use Active or Passive mode for FTP?

FTP exists primarily for the transfer of data between two end points. FTP differs from HTTP (Hyper Text Transfer Protocol, used for serving websites via web browsers) fundamentally, as it is an application made up of typically two distinct TCP connections:

• Control connection: This TCP-based connection is used to provide a communication channel for the delivery of commands and replies. This is effectively the mechanism that enables the user to tell the server which file is being requested, which directory it is in, and so on.
• Data connection: The second TCP-based connection is used for the actual transfer of user data. Once the Control connection has been used to exchange information on which file is required, the Data connection is used to transfer the file between the client and server.

Using these two communication connections, two distinct modes of operation determine in which direction the connections are established - Active mode and Passive mode.

FTP is a TCP based service exclusively. There is no UDP component to FTP. FTP is an unusual service in that it utilizes two ports, a Data port and a Command port (also known as the Control port). Traditionally these are port 21 for the Command (Control) port and port 20 for the Data port. The confusion begins however, when we find that depending on the mode, the data port is not always on port 20.

Active FTP

In active mode FTP, the FTP client software connects from a random unprivileged (unprivileged port is a port which is higher than 1023) port. Let us say N is the FTP server's command port, port no. 21. Then, the client starts listening to port N+1 and sends the FTP command PORT N+1 to the FTP server. The server will then connect back to the client's specified data port from its local data port, which is port no. 20. Here in this mode of FTP, we do not need to open any additional non-secure ports on our servers firewall and hence is secure from the server-side.

Passive FTP

In passive mode FTP, the FTP client initiates both connections to the server. When opening an FTP connection, the client opens two random unprivileged ports, let us say N and N+1. The first port contacts the server on port no. 21, but instead of then issuing a PORT command and allowing the server to connect back to its data port, the client will issue the PASV command. The result of this is that the server then opens a random unprivileged port, let us say P, and sends the PORT command back to the client. The client then initiates the connection from port no. N+1 to port no. P on the server to transfer data. This method of FTP is insecure, as a random unprivileged port is opened on the Server. This is a potential security issue and it isn't advisable to use the Passive mode of FTP.