How to ensure the connection is secure when using ftp_rawlist

When handling FTP operations in PHP, the ftp_rawlist() function is a very practical tool that allows us to get a list of detailed information for a specified directory, similar to the ls -l command in UNIX systems. However, since the FTP protocol itself is transmitted plaintext, if it is not protected when using ftp_rawlist() , it will face serious security risks, such as credentials being stolen, man-in-the-middle attacks, etc. This article will explore how to effectively ensure the connection security when using ftp_rawlist() to obtain information.

1. Security issues of the FTP protocol

Since its inception, security has been one of its criticized issues. Here are some major security risks when using standard FTP connections:

• Plain text transfer account password : Attackers can easily intercept login credentials through network sniffing.

• Data transmission is not encrypted : directory lists and file contents are also transmitted in plain text.

• Vulnerable to man-in-the-middle attacks (MITM) : Due to the lack of a verification mechanism, the communication content can be tampered with.

Therefore, if you use the following code directly, you will face the above risks:

 $conn = ftp_connect("gitbox.net");
$login = ftp_login($conn, "username", "password");
$list = ftp_rawlist($conn, "/");
print_r($list);

2. Use FTPS to increase security

In order to solve the security problems of traditional FTP, FTPS (FTP Secure) is recommended. FTPS adds an SSL/TLS encryption layer to the FTP protocol, which can effectively prevent information leakage caused by plain text transmission.

Using FTPS in PHP is very simple:

 $conn = ftp_ssl_connect("gitbox.net");
if (!$conn) {
    die("Unable to establish a secure connection");
}

$login = ftp_login($conn, "username", "password");
if (!$login) {
    die("Login failed");
}

$list = ftp_rawlist($conn, "/");
print_r($list);

ftp_close($conn);

ftp_ssl_connect() is a secure alternative to ftp_connect() , which establishes encrypted connections. In this way, username, password, command and data transmission will be encrypted through TLS, effectively improving communication security.

3. Passive mode and firewall

When using FTP, especially FTPS, you often encounter connection failure problems. One common reason is that there is a firewall between the client and the server blocking the data channel. This problem can be solved by enabling passive mode:

 ftp_pasv($conn, true);

When passive mode is enabled, the data connection will be initiated by the client, which can avoid most firewall problems.

4. The importance of certificate verification

When using ftp_ssl_connect() , PHP does not verify the server certificate by default. Although the data is encrypted, the attacker can still forge the server. If possible, it is recommended to manually verify the certificate at the bottom or resolve the issue through a proxy. Although the FTP extension of PHP does not natively support certificate verification, consider using more advanced libraries such as cURL (with FTP over TLS/SSL) for more granular control.

5. Summary

When using ftp_rawlist() to obtain remote file directory information, do not ignore the security risks of the FTP protocol. Recommended security practices include:

• Use ftp_ssl_connect() instead of ftp_connect() ;

• Always turn on passive mode to bypass firewall restrictions;

• Verify the server certificate as much as possible;

• Avoid using unencrypted FTP operations in production environments.

Through the above measures, the security risks brought by FTP operations can be significantly reduced and the integrity and confidentiality of data transmission can be protected.