Port 990 – FTPS Control

TCP

Port 990 is the implicit FTPS control channel port – FTP commands encrypted with TLS from the first byte. Unlike explicit FTPS (AUTH TLS on port 21), port 990 requires TLS before any FTP commands are sent. Paired with port 989 for encrypted data transfer. Less common than explicit FTPS due to NAT traversal difficulties.

Port Number

990

Protocol

TCP

Service

FTP over TLS (Control)

Range

IANA Well-Known (0–1023)

Description

FTPS control on port 990 provides the encrypted command channel for implicit FTP over TLS. All FTP commands (USER, PASS, LIST, RETR, STOR) travel encrypted from connection establishment. The server presents its TLS certificate immediately on TCP connect. Implicit FTPS on port 990 predates the STARTTLS approach used by explicit FTPS on port 21. Most FTP clients and servers support both modes. Explicit FTPS is generally preferred because it works better with firewalls and NAT – the client can negotiate TLS after connecting to the standard port 21. Port 990 remains useful when you need to guarantee encryption without relying on client STARTTLS negotiation.

Security risks

1Same vulnerabilities as port 989 (FTPS data) – see port 989 for detailed risks
2Credential exposure on fallback: if TLS negotiation fails and client falls back to port 21 (plaintext FTP), username and password are sent in cleartext
3vsftpd SSL configuration pitfalls: ssl_enable=YES without force_local_logins_ssl=YES allows unencrypted login, leaking credentials even when TLS is 'enabled'
4FTP bounce attack (PORT command): even over TLS, misconfigured servers allow PORT commands directing data connections to arbitrary hosts (network scanning proxy)
5Session hijacking via TLS renegotiation: older TLS implementations allowed renegotiation attacks that could inject commands into an established FTPS session

Firewall guidance

If using implicit FTPS: open port 990 (control) and a defined passive port range. Ensure force_ssl/require_ssl is enabled to prevent plaintext fallback. Disable SSLv3/TLS 1.0/1.1 in server config. Validate client certificates for B2B transfers. Prefer SFTP (port 22) for new deployments – eliminates the dual-port complexity entirely.

Diagnosis commands

Note: for implicit FTPS do NOT use -starttls (it's already TLS). Use: openssl s_client -connect server:990

shell

openssl s_client -connect server:990 -starttls ftp

Full implicit FTPS session with data channel protection

shell

lftp -e 'set ftp:ssl-force true; set ftp:ssl-protect-data true; ls; quit' -u user,pass server:990

Audit vsftpd TLS configuration

shell

grep -E 'ssl_enable|force.*ssl|implicit_ssl' /etc/vsftpd/vsftpd.conf

Extract FTPS server certificate for validation

shell

nmap -p 990 --script ssl-cert target

Usage examples

Port 990 – FTPS Control

shell

openssl s_client -connect host:990
curl --ftp-ssl-reqd ftps://host:990/
lftp -e 'set ftp:ssl-force true; set ftp:ssl-protect-data true' ftps://host

Common services on this port

vsftpd (implicit_ssl=YES)ProFTPD (TLSRequired)Pure-FTPd (--tls=2)IIS FTP ServiceCerberus FTP

Related ports

989

FTPS data (implicit TLS)

990

FTPS control (this port)

FTP control (explicit TLS via AUTH TLS)

SFTP (simpler, SSH-based)

History

Port 990 for implicit FTPS was proposed in a 1996 Internet Draft (draft-murray-auth-ftp-ssl). Unlike explicit FTPS (AUTH TLS on port 21, which became RFC 4217 in 2005), implicit FTPS was never formally standardized. It wraps the entire FTP session in TLS from connection establishment – the client connects to 990 and immediately performs a TLS handshake. The IETF preferred explicit TLS, but implicit FTPS persists in enterprise environments, particularly banking and healthcare file exchange.

FAQ

Why do banks still use FTPS instead of SFTP?

Regulatory inertia and established processes. Many financial institutions set up FTPS in the early 2000s when SFTP implementations were less mature. Their compliance frameworks reference 'FTP over TLS' specifically. Switching requires: renegotiating connectivity agreements with every partner, updating firewall rules, rewriting automation scripts, and re-certifying with auditors. The technical choice matters less than the operational cost of changing.

How do I configure vsftpd for implicit FTPS?

vsftpd.conf: listen=YES, listen_port=990, implicit_ssl=YES, ssl_enable=YES, force_local_logins_ssl=YES, force_local_data_ssl=YES, ssl_tlsv1_2=YES, ssl_sslv2=NO, ssl_sslv3=NO, rsa_cert_file=/path/cert.pem, rsa_private_key_file=/path/key.pem, pasv_min_port=50000, pasv_max_port=50100. Ensure require_ssl_reuse=NO if clients don't support TLS session resumption (common compatibility issue).

Specification

RFC 4217 – Port 990 specification →