Connections and security

Connections and security

TideFTP supports SFTP, FTP, explicit FTPS, and implicit FTPS.

Pick the protocol

Protocol	Default port	Encryption
sftp	22	SSH
ftp	21	None
ftps	21	Starts as FTP, then upgrades with AUTH TLS
ftps-implicit	990	Starts with a TLS handshake

Explicit and implicit FTPS are separate protocols. A server normally supports one mode on a given port. TideFTP does not fall back between them.

Authenticate to SFTP

TideFTP tries the SSH agent and the usual SSH key files. Use --identity FILE to select a key. If key authentication fails, TideFTP can read a password from the operating system keyring, TIDEFTP_SFTP_PASSWORD, or standard input with --password-stdin.

TideFTP checks host keys against ~/.ssh/known_hosts by default. To add a host key, connect once with OpenSSH:

ssh user@files.example.com

Use --known-hosts FILE to select another file. --host-key-policy off accepts any host key and permits machine-in-the-middle attacks. Use it only for a disposable test system.

Authenticate to FTP and FTPS

FTP and FTPS require a password. TideFTP can read it from a saved profile's keyring entry, TIDEFTP_FTP_PASSWORD, or standard input:

vault read -field=password secret/ftp | \
  tideftp ls --profile prod --password-stdin

TideFTP does not accept a password flag because command-line arguments are visible in the process table.

Plain FTP does not encrypt credentials or file contents. Use SFTP or FTPS unless the server leaves no alternative.

Verify FTPS certificates

Both FTPS modes verify the server certificate. To trust a private certificate authority, pass its certificate:

tideftp --protocol ftps --ftps-ca company-ca.pem --host files.example.com

--ftps-insecure disables certificate verification. Use it only for a disposable test system.

TideFTP limits FTPS to TLS 1.2 by default because some FTP servers corrupt data connections under TLS 1.3. Pass --ftps-allow-tls13 if your server supports TLS 1.3 correctly.

Save a profile

A profile stores connection details without credentials:

[[profiles]]
name = "prod"
protocol = "sftp"
host = "files.example.com"
port = 22
user = "deploy"
start_path = "/var/www"
host_key_policy = "strict"

Use it from the command line with --profile prod. A command-line flag overrides the matching profile field for that run.

This page describes source revision b1fb600.