FTP Operation

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20

# FTP Connection Establishment Example
# Client: 192.168.1.100
# Server: ftp.example.com (203.0.113.50)
 
# TCP Three-Way Handshake (Layer 4)
[TCP] 192.168.1.100:54321 → 203.0.113.50:21 [SYN]
[TCP] 203.0.113.50:21 → 192.168.1.100:54321 [SYN, ACK]
[TCP] 192.168.1.100:54321 → 203.0.113.50:21 [ACK]
 
# FTP Control Channel Established
# Server sends welcome banner immediately after TCP connection
 
← 220-Welcome to Example Corporation FTP Server
← 220-
← 220-This system is for authorized users only.
← 220-All activities may be logged and monitored.
← 220 Server ready for new user.
 
# Client now in Authorization state
# Next step: Send USER command with username

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21

# Typical USER Command Exchange
 
# Scenario 1: Normal user requiring password
→ USER johndoe
← 331 Password required for johndoe.
 
# Scenario 2: Anonymous access
→ USER anonymous
← 331 Anonymous access allowed, send email as password.
 
# Scenario 3: User does not exist or is disabled
→ USER invaliduser
← 530 User invaliduser access denied.
 
# Scenario 4: User with immediate access (rare)
→ USER trusted-host
← 230 User trusted-host logged in, proceed.
 
# Scenario 5: Server requires account specification
→ USER projectuser
← 332 Need account for login.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39

# Complete Authentication Sequence
 
# Step 1: Connection established, receive banner
← 220 ProFTPD 1.3.6 Server (Example FTP) [203.0.113.50]
 
# Step 2: Send username
→ USER developer
← 331 Password required for developer
 
# Step 3: Send password
→ PASS MySecur3P@ssw0rd!
← 230 User developer logged in
 
# Step 4: Session now authenticated - can execute commands
→ PWD
← 257 "/home/developer" is the current directory
 
# ============================================
# FAILED AUTHENTICATION EXAMPLE
# ============================================
 
← 220 ProFTPD 1.3.6 Server (Example FTP) [203.0.113.50]
 
→ USER developer
← 331 Password required for developer
 
→ PASS wrongpassword
← 530 Login incorrect.
 
# Server may allow retry or disconnect after repeated failures
→ USER developer
← 331 Password required for developer
 
→ PASS anotherbadpassword
← 530 Login incorrect.
 
# Many servers disconnect after 3 failed attempts
← 421 Too many login failures - goodbye.
Connection closed by remote host.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30

# Example 1: ACCT Required for Full Access
← 220 Legacy Banking FTP Server Ready
→ USER analyst.smith
← 331 Password required
→ PASS SecurePass123
← 332 Need account for login
→ ACCT PROJ-TRADING-2024
← 230 User logged in, access to trading project files
 
# Example 2: ACCT Not Needed (Modern Server)
← 220 ProFTPD Ready
→ USER developer
← 331 Password required
→ PASS MyPassword
← 230 User logged in
→ ACCT billing-department
← 202 Command not implemented, superfluous at this site
 
# Example 3: Multiple Accounts for Same User
# (Rare mainframe-era scenario)
→ USER multiproject.user
← 331 Password required
→ PASS SharedCreds
← 332 Need account specification
→ ACCT PROJECT-ALPHA
← 230 Access granted to Project Alpha files
 
# Later in session, switch accounts:
→ ACCT PROJECT-BETA
← 230 Access switched to Project Beta files

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23

# Wireshark/tcpdump Capture of FTP Login
# An attacker on the network path can see everything
 
Frame 1: TCP [SYN] to port 21
Frame 2: TCP [SYN,ACK] from port 21
Frame 3: TCP [ACK]
Frame 4: FTP Response "220 Server Ready"
 
Frame 5: FTP Request "USER administrator"
# Attacker now knows the username: administrator
 
Frame 6: FTP Response "331 Password required"
 
Frame 7: FTP Request "PASS Sup3rS3cr3tP@ssw0rd!"
# Attacker now has the password: Sup3rS3cr3tP@ssw0rd!
 
Frame 8: FTP Response "230 User logged in"
 
# Complete credentials captured: administrator / Sup3rS3cr3tP@ssw0rd!
# Attack vectors now available:
# - Direct FTP access
# - Credential reuse attacks on other systems
# - Session hijacking on this connection

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27

# Explicit FTPS Login Sequence
 
# Step 1: Standard TCP connection to port 21
← 220 Welcome to Secure FTP Server
 
# Step 2: Request TLS upgrade
→ AUTH TLS
← 234 AUTH TLS successful
 
# Step 3: TLS Handshake occurs (encrypted from here)
# ClientHello, ServerHello, Certificate, KeyExchange, etc.
[TLS negotiation completed - connection now encrypted]
 
# Step 4: Set protection level for data channel
→ PBSZ 0
← 200 PBSZ set to 0
→ PROT P
← 200 PROT now Private
 
# Step 5: Encrypted authentication
→ USER secureuser
← 331 Password required for secureuser
→ PASS MyEncryptedPassword
← 230 User logged in
 
# All credentials transmitted over TLS encryption
# Network observers see only encrypted bytes

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232

import socket
import ssl
from enum import Enum, auto
from dataclasses import dataclass
from typing import Optional, Tuple
 
class FTPState(Enum):
    NOT_CONNECTED = auto()
    CONNECTED = auto()
    USER_SENT = auto()
    AUTHENTICATED = auto()
    SECURED = auto()  # TLS active
 
@dataclass
class FTPResponse:
    code: int
    message: str
    is_multiline: bool
    
    @property
    def is_success(self) -> bool:
        return 200 <= self.code < 400
    
    @property
    def needs_password(self) -> bool:
        return self.code == 331
    
    @property
    def needs_account(self) -> bool:
        return self.code == 332
 
class SecureFTPClient:
    """
    Robust FTP client with proper state management and TLS support.
    Demonstrates production-quality login implementation.
    """
    
    def __init__(self, host: str, port: int = 21, 
                 timeout: float = 30.0, use_tls: bool = True):
        self.host = host
        self.port = port
        self.timeout = timeout
        self.use_tls = use_tls
        self.state = FTPState.NOT_CONNECTED
        self.sock: Optional[socket.socket] = None
        self.file = None  # For readline operations
        
    def connect(self) -> FTPResponse:
        """Establish TCP connection and receive welcome banner."""
        if self.state != FTPState.NOT_CONNECTED:
            raise RuntimeError("Already connected")
            
        self.sock = socket.create_connection(
            (self.host, self.port), 
            timeout=self.timeout
        )
        self.file = self.sock.makefile('r', encoding='utf-8')
        self.state = FTPState.CONNECTED
        
        response = self._receive_response()
        if response.code != 220:
            raise ConnectionError(
                f"Server rejected connection: {response.message}"
            )
        return response
    
    def upgrade_to_tls(self) -> FTPResponse:
        """Upgrade connection to TLS (explicit FTPS)."""
        if self.state != FTPState.CONNECTED:
            raise RuntimeError("Must be connected before TLS upgrade")
        
        # Request TLS
        self._send_command("AUTH TLS")
        response = self._receive_response()
        
        if response.code != 234:
            raise RuntimeError(f"TLS upgrade failed: {response.message}")
        
        # Wrap socket with TLS
        context = ssl.create_default_context()
        self.sock = context.wrap_socket(
            self.sock, 
            server_hostname=self.host
        )
        self.file = self.sock.makefile('r', encoding='utf-8')
        
        # Set up data channel protection
        self._send_command("PBSZ 0")
        self._receive_response()
        self._send_command("PROT P")
        self._receive_response()
        
        self.state = FTPState.SECURED
        return response
    
    def login(self, username: str, password: str, 
              account: Optional[str] = None) -> FTPResponse:
        """
        Complete login sequence with proper state management.
        
        Handles:
        - Normal USER/PASS authentication
        - Optional TLS upgrade before authentication
        - ACCT command if required (332 response)
        - Retry logic for transient failures
        """
        if self.state not in (FTPState.CONNECTED, FTPState.SECURED):
            raise RuntimeError("Not ready for login")
        
        # Upgrade to TLS if requested and not already secured
        if self.use_tls and self.state != FTPState.SECURED:
            self.upgrade_to_tls()
        
        # Send USER command
        self._send_command(f"USER {username}")
        response = self._receive_response()
        self.state = FTPState.USER_SENT
        
        if response.code == 230:
            # No password needed (rare)
            self.state = FTPState.AUTHENTICATED
            return response
        
        if response.code == 530:
            raise PermissionError(f"User rejected: {response.message}")
        
        if not response.needs_password:
            raise RuntimeError(f"Unexpected response: {response.code}")
        
        # Send PASS command
        self._send_command(f"PASS {password}")
        response = self._receive_response()
        
        if response.code == 230:
            self.state = FTPState.AUTHENTICATED
            return response
        
        if response.needs_account:
            if account is None:
                raise ValueError("Server requires account (ACCT)")
            self._send_command(f"ACCT {account}")
            response = self._receive_response()
            if response.code == 230:
                self.state = FTPState.AUTHENTICATED
                return response
        
        if response.code == 530:
            raise PermissionError(f"Login failed: {response.message}")
        
        raise RuntimeError(f"Unexpected response: {response.code}")
    
    def _send_command(self, command: str) -> None:
        """Send FTP command with proper line termination."""
        self.sock.sendall(f"{command}\r
".encode('utf-8'))
    
    def _receive_response(self) -> FTPResponse:
        """
        Parse FTP response, handling multi-line responses.
        
        Multi-line format: 
          XXX-First line
          XXX-Middle lines
          XXX Final line (space after code)
        """
        lines = []
        while True:
            line = self.file.readline().rstrip('\r
')
            lines.append(line)
            
            # Check if this is the final line
            if len(line) >= 4 and line[3] == ' ':
                break
            # Continue if hyphen (multi-line)
            if len(line) >= 4 and line[3] == '-':
                continue
            # Single line response
            break
        
        code = int(lines[0][:3])
        message = '
'.join(lines)
        is_multiline = len(lines) > 1
        
        return FTPResponse(code, message, is_multiline)
    
    def quit(self) -> None:
        """Gracefully close FTP session."""
        if self.state != FTPState.NOT_CONNECTED:
            try:
                self._send_command("QUIT")
                self._receive_response()
            except:
                pass  # Best effort
            finally:
                self.sock.close()
                self.state = FTPState.NOT_CONNECTED
 
 
# Usage Example
def main():
    client = SecureFTPClient(
        host="ftp.example.com",
        port=21,
        use_tls=True,
        timeout=30.0
    )
    
    try:
        print("Connecting...")
        welcome = client.connect()
        print(f"Server: {welcome.message}")
        
        print("Authenticating...")
        result = client.login(
            username="developer",
            password="SecurePass123"
        )
        print(f"Login: {result.message}")
        
        # Now authenticated - can perform file operations
        
    except ConnectionError as e:
        print(f"Connection failed: {e}")
    except PermissionError as e:
        print(f"Authentication failed: {e}")
    finally:
        client.quit()
 
if __name__ == "__main__":
    main()