FTPS — legacy workflows with encrypted FTP

FTPS is classic FTP with a TLS encryption layer. Functionally similar to old FTP, but username, password and content travel encrypted over the wire. For modern workflows most people use SFTP — FTPS remains for special tools and hardware (printers, industrial devices) that can’t do anything else.

FTPS vs SFTP — in short

	FTPS	SFTP
Basis	FTP over TLS	over SSH
Ports	21 (control) + dynamic (data)	22
Firewall-friendly	no (data ports)	yes (port 22 only)
Adoption	legacy industry, old tools	today’s standard
Setup complexity	medium (active/passive modes)	simple

Our recommendation: if you can choose, take SFTP. FTPS only when a tool understands nothing else.

When you need FTPS

Classic use cases:

• Old office software with an FTP upload feature
• Industrial printers with FTP scan-to-cloud
• Web-hosting auto-deploy tools (older ones)
• Embedded devices (cameras, IoT) with FTP upload

Modern software usually offers SFTP or WebDAV as an alternative.

Server details

For storageDRIVE:

• Server: drive.xaweho.de
• Port: 21 (standard FTP) or 990 (FTPS implicit) — we prefer port 21 with explicit TLS
• Username: your DSM username
• Password: your regular account password — FTPS never asks for a 2FA code, so a strong password is mandatory
• Encryption: TLS explicit (FTPES) or TLS implicit (FTPS) — both active

Setup examples

FileZilla (Mac, Win, Linux — free)

The standard FTP client.

1. File → Site Manager → New site
2. Enter:
   • Protocol: FTP — File Transfer Protocol
   • Host: drive.xaweho.de
   • Port: 21
   • Encryption: Require explicit FTP over TLS
   • Logon type: Normal
   • User: your username
   • Password: your account password
3. Connect

Cyberduck (Mac, Win — free)

1. Open Connection
2. Protocol: FTP-SSL (Explicit AUTH TLS)
3. Server, port 21, username, password
4. Connect

CLI with lftp (Linux, Mac with Homebrew)

lftp -u username,password ftps://drive.xaweho.de

Make sure it’s ftps:// (with TLS), not ftp:// (plain text).

Commands: ls, cd, get, put, mirror (for sync).

Script example: backup to storageDRIVE via FTPS

#!/bin/bash
HOST="drive.xaweho.de"
USER="mueller"
PASS="<account-passwort>"
SOURCE="/local/data"

lftp -u $USER,$PASS ftps://$HOST << EOF
mirror -R $SOURCE /home/mueller/Backup
quit
EOF

Crontab entry for a nightly run:

0 3 * * * /pfad/zu/backup-skript.sh

Active vs passive mode

FTP uses two connections: control (port 21) and data (a separate port).

• Active: the server initiates the data connection to the client. Doesn’t work behind firewalls / NAT.
• Passive: the client initiates both connections. Today’s default, gets through almost every firewall.

For storageDRIVE: enable passive. On the client side it’s the default.

In FileZilla → Settings → Connection → FTP → choose Passive.

Troubleshooting

”Connection refused” / timeout

• Port 21 reachable: often blocked by company firewalls. Test: telnet drive.xaweho.de 21
• Wrong encryption: explicit TLS must be enabled
• Wrong IP: on mobile connections, occasional NAT problems — try Wi-Fi

”Login failed”

• Password correct? FTPS uses your regular account password — no 2FA code is requested here
• Username correct? → no @domain.de, just the username

”File upload aborts”

• Bandwidth problems — test with smaller files
• Server quota full
• Account password changed recently? Store the new password in the tool

Poor performance

• With many small files: FTPS is slow. SFTP or WebDAV are better.
• Check for a bandwidth limit on the client side

Security

Important: enable explicit TLS, otherwise the login travels the wire in plain text.

On the server side we accept no unencrypted FTP — if you try to connect without TLS, you get a login error.

What you should know about FTPS

• Not suited for sharing — the FTP protocol has no sharing-link concept
• No file locks — if two clients write the same file, one of them wins
• Limited file metadata — FTP transfers date/size, nothing more
• No resumable upload after a dropped connection (compared to rclone+WebDAV)

For modern workflows: SFTP or WebDAV.

Frequently asked questions

Does FTPS work over a mobile connection? Sometimes not, because mobile providers block port 21 traffic. SFTP (port 22) is blocked less often.

Multiple FTPS connections in parallel? Yes, no problem.

Can I create sharing links via FTPS? No — FTPS doesn’t know the concept. Share via the DSM web UI or Drive.

How many users can log in via FTPS at the same time? One plan = one user account, so exactly one FTPS login. Multiple parallel connections with that login are no problem. If you need separate logins for several people: one plan per person, or Nextcloud Hosting with unlimited users.

FTPS vs SFTP performance? SFTP is usually faster with small files (less setup overhead per file). FTPS has advantages when streaming large files.

Can I have an FTPS password separate from my DSM account? No. FTPS always uses your DSM login — DSM has no separate app passwords. All the more important: a strong account password from a password manager. For scripts, SFTP with an SSH key is the cleaner choice.

Does FTPS work with auto-deployment tools like GitLab/GitHub Actions? Yes, it’s a standard CI/CD method. Use lftp or curl --ssl in your pipeline scripts.

What’s next

• SFTP access
• WebDAV access
• 2FA in DSM