FTP/FTPS Support

Stylus SFTP Server includes an FTP/FTPS listener alongside the primary SFTP listener. Built on Apache FtpServer 1.2.0, it supports both implicit and explicit TLS modes. FTP users share the same user accounts, home directories, disk quotas, and audit trail as SFTP — no separate configuration is required.

Enabling FTP

The FTP listener is disabled by default. To enable it, uncomment (or add) the FTP listener block in sftp-server.xml:

<listener type="ftp">
    <enabled>true</enabled>
    <port>21</port>
    <idle-timeout-seconds>600</idle-timeout-seconds>
    <passive-ports-start>50000</passive-ports-start>
    <passive-ports-end>50100</passive-ports-end>
</listener>

Once enabled, the FTP listener starts on the configured port and accepts connections using the same authentication providers as SFTP (LDAP, JDBC, XML, or public key).

TLS Modes

Stylus SFTP Server supports three FTP connection modes:

Explicit TLS (STARTTLS) — Recommended

The client connects on the standard FTP port (typically 21) and issues an AUTH TLS command to upgrade the connection to TLS. This is the most widely supported mode and is recommended for most deployments.

Add <explicit-ssl>true</explicit-ssl> and the keystore settings inside the <listener type="ftp"> block in conf/sftp-server.xml:

<!-- in conf/sftp-server.xml -->
<listeners>
    <listener type="ftp">
        <enabled>true</enabled>
        <port>21</port>
        <explicit-ssl>true</explicit-ssl>
        <keystore-path>${STYLUS_SFTPSERVER_DATA}/conf/ftpserver.p12</keystore-path>
        <keystore-password>yourpassword</keystore-password>
        <ssl-protocols>TLSv1.2,TLSv1.3</ssl-protocols>
    </listener>
</listeners>

Implicit TLS

The client connects directly over TLS on a dedicated port (typically 990). There is no plaintext phase — TLS is established immediately.

Use <implicit-ssl>true</implicit-ssl> instead of <explicit-ssl> in the same location:

<!-- in conf/sftp-server.xml -->
<listeners>
    <listener type="ftp">
        <enabled>true</enabled>
        <port>990</port>
        <implicit-ssl>true</implicit-ssl>
        <keystore-path>${STYLUS_SFTPSERVER_DATA}/conf/ftpserver.p12</keystore-path>
        <keystore-password>yourpassword</keystore-password>
        <ssl-protocols>TLSv1.2,TLSv1.3</ssl-protocols>
    </listener>
</listeners>

Plain FTP (No TLS)

If neither <explicit-ssl> nor <implicit-ssl> is set in the <listener type="ftp"> block, the listener accepts unencrypted FTP connections. No keystore configuration is needed.

Keystore Configuration

When TLS is enabled (explicit or implicit), a Java keystore containing the server certificate and private key is required. Configure it in the FTP listener block:

<keystore-path>${STYLUS_SFTPSERVER_DATA}/conf/ftpserver.p12</keystore-path>
<keystore-password>changeit</keystore-password>
<ssl-protocols>TLSv1.2,TLSv1.3</ssl-protocols>
<enabled-cipher-suites></enabled-cipher-suites>  <!-- empty = JVM defaults -->
<key-alias></key-alias>                           <!-- empty = first entry -->
<key-password></key-password>                     <!-- empty = keystore password -->

Certificate Management

All three administration tools — CLI, Swing GUI, and web console — provide certificate management operations for the FTPS keystore:

The Swing admin provides a dedicated Certificates tab with the same operations in a graphical interface. The web console exposes equivalent REST endpoints.

Installing a Production SSL Certificate

The installer generates a self-signed certificate for initial setup. For production use, you should replace it with a certificate from a trusted Certificate Authority (CA) such as DigiCert, Let's Encrypt, or your organization's internal CA. This eliminates security warnings in FTP clients and ensures the server's identity is verified.

Step 1 — Generate a Certificate Signing Request (CSR)

If your CA requires a CSR, generate one using keytool from the server's bundled JRE. Use the hostname that clients will connect to as the Common Name (CN):

# Generate a new keypair and CSR
keytool -genkeypair -alias ftpserver -keyalg RSA -keysize 2048 \
    -dname "CN=sftp.yourcompany.com,O=Your Company,C=US" \
    -keystore conf/ftpserver.p12 -storetype PKCS12 -storepass yourpassword

# Export the CSR to send to your CA
keytool -certreq -alias ftpserver \
    -keystore conf/ftpserver.p12 -storetype PKCS12 -storepass yourpassword \
    -file server.csr

Send server.csr to your CA. They will return a signed certificate (usually as .pem, .crt, or .cer files).

Step 2 — Import the Signed Certificate

Once you receive the signed certificate from your CA, import it using one of these methods:

Option A — Import PEM files (certificate + private key)

If your CA provided separate PEM files for the certificate and private key:

admin import-pem --cert server.pem --key server-key.pem

Option B — Import a PKCS12 (.p12 / .pfx) file

If your CA or IT department provided a .p12 or .pfx file containing the certificate and private key:

admin import-p12 --source signed-cert.p12 --source-password capassword

Option C — Use Let's Encrypt (free, automated)

Let's Encrypt provides free certificates. After obtaining the certificate with certbot or a similar tool, import the PEM files:

# Typical Let's Encrypt file locations (Linux)
admin import-pem --cert /etc/letsencrypt/live/sftp.yourcompany.com/fullchain.pem \
                 --key  /etc/letsencrypt/live/sftp.yourcompany.com/privkey.pem

Let's Encrypt certificates expire every 90 days. Set up a cron job or scheduled task to re-import after renewal. The server's admin alert system will email administrators when the certificate is within 30 days of expiry.

Step 3 — Verify the Certificate

After importing, verify the certificate is installed correctly:

admin list-certs

Step 4 — Restart the FTPS Listener

The FTPS listener loads the keystore at startup. After importing a new certificate, restart the server for the change to take effect:

admin stop-server
admin start-server

Or restart the Windows service from the Services console.

Installer FTPS Setup

The installer can configure FTPS during the initial installation, eliminating the need to edit configuration files manually.

GUI Installer

The SSL configuration panel provides:

• SSL mode dropdown: Explicit TLS, Implicit TLS, or None
• Keystore file path and password fields

CLI Installer

Use command-line flags to configure FTPS non-interactively:

--ftpssl explicit|implicit --ftpkeystorepath /path/to/keystore.p12 --ftpkeystorepassword pass

If no keystore is provided, the installer automatically generates a self-signed certificate for immediate use.

Passive Port Range

FTP uses separate connections for data transfer. In passive mode (required for NAT and firewall traversal), the server opens a listening port from a configured range and the client connects to it.

<passive-ports-start>50000</passive-ports-start>
<passive-ports-end>50100</passive-ports-end>

You must open these ports in your firewall alongside the FTP control port. The range should be large enough to accommodate the expected number of concurrent data transfers.

Known Limitations

The following TLS-related features are not currently supported in the FTPS listener: