Technical Anshu
Tutorials Blog
FTPS and SFTP Guide

Enable FTPS and SFTP in Cerberus FTP Server Turn Encryption On

Plain FTP exposes every password. Cerberus already includes the encrypted options - here is how to switch them on and make them mandatory.

Technical AnshuWindowsEncryption setup for FTP, FTPS and SFTP
Watch - the Cerberus install in the video, then turn on FTPS and SFTP with this page

Cerberus can do plain FTP, FTPS and SFTP from the same install - but only the last two protect you. Plain FTP sends passwords in clear text. This page shows how to enable the encrypted listeners, how to require them so nobody logs in the insecure way by habit, and how to set FileZilla and WinSCP so the client side matches.

FileZilla - Plain FTP vs Encrypted Connection, Example Wording
Plain FTP login: Status: Insecure server, it does not support FTP over TLS. FTPS login: Status: TLS connection established. Status: Logged in
Plain FTPPassword visible in traffic
FTPS / SFTPPassword and files encrypted
Example client wording. If your client warns the server is insecure, you are still on plain FTP - stop and fix the protocol, do not click through.
Cerberus Listeners - Secure Options, Example Values
FTP port 21Require TLS for explicit FTPS, or disable for internet use
FTPS port 990Implicit TLS, secure only
SFTP port 22SSH, secure only, one port
Example listener choices. SFTP is often the simplest secure option because it needs only port 22 and has no passive range.
1

Understand the Three Protocols Without Confusion

Cerberus speaks several protocols, and their names are confusingly similar. Getting this straight is the whole case.

  1. FTP on port 21 - the original protocol. No encryption at all. Passwords and files travel as readable text.
  2. FTPS - FTP protected by TLS, the same kind of encryption as HTTPS. Implicit FTPS on port 990 is secure from the first second. Explicit FTPS starts on port 21 and upgrades to TLS during login - your server and client must both require that upgrade.
  3. SFTP on port 22 - despite the name, this is not FTP. It is file transfer over SSH. It encrypts everything and uses a single port, which makes firewall work much simpler.
  4. HTTPS on port 443 - browser based transfer where your edition includes the web client. Also TLS encrypted.
2

Turn On FTPS in Cerberus Step by Step

  1. Make sure the server has a certificate. Cerberus can use a self signed certificate for a start - the certificate page in this series explains its limits honestly.
  2. In Server Manager, check the FTPS listener on port 990 is enabled, or open the port 21 listener settings and require TLS so explicit FTPS upgrades are mandatory, not optional.
  3. In each user account, or in the listener policy where your edition puts it, enable Require Secure Connection so a plain FTP login for that user is refused.
  4. Restart or apply the listener change as Cerberus prompts, then test before telling users it is ready.
3

Turn On SFTP in Cerberus Step by Step

  1. Enable the SSH SFTP listener on port 22 in Server Manager and confirm the server has an SSH host key - Cerberus manages this as part of the SFTP setup.
  2. Give users SFTP access in their account settings and keep their folder permissions the same careful per folder pattern as FTP.
  3. Open only port 22 in the firewall for SFTP users. SFTP has no passive port range - that alone is a strong reason many admins prefer it.
  4. Optionally, move to key based login for admin or automated accounts later. A password is acceptable to start; a key is stronger, and the two can be combined where supported.
4

Connect From the Client Correctly

Most failed secure setups are actually client mistakes. In FileZilla Quickconnect, the protocol choice decides everything.

  1. For FTPS, choose FTP - File Transfer Protocol with encryption set to require explicit FTP over TLS, or use host prefix for implicit on port 990 as your client requires. Never leave encryption on plain FTP if the server offers TLS.
  2. For SFTP, choose SFTP - SSH File Transfer Protocol and port 22. If you type an FTP address into an SFTP profile, login will fail even with the right password.
  3. The first connection shows a certificate or host key prompt. That prompt is the security working - confirm it once on a trusted network instead of disabling verification.
  4. In WinSCP, pick the protocol from the dropdown first - File protocol SFTP, FTPS or FTP are three separate choices with the same address box.
5

Close the Plain Door After Opening the Secure One

Leaving plain FTP enabled next to FTPS is the most common honest mistake. Users keep old bookmarks and saved profiles, and those still send passwords in clear text. Once secure connections test clean, disable plain FTP logins or restrict the port 21 listener to the LAN only. A server that offers both will be used in the weaker way by someone, eventually.

Honest test - connect the way your users will connect, and read what the client says. If it does not clearly show TLS or SSH encryption established, you are not encrypted yet, whatever the server settings page claims.

Watch the Complete Video Guide

The video gets Cerberus running in minutes - this page makes that same server encrypted, step by step.

Watch Full Video
Common Questions (FAQ)

What is the difference between FTPS and SFTP in Cerberus

FTPS is the FTP protocol protected by TLS, on port 990 for implicit or port 21 for explicit. SFTP is a different protocol over SSH on port 22. Both encrypt passwords and files. SFTP is simpler through firewalls because it needs only one port and no passive range.

Should I disable plain FTP completely

For any server reachable from the internet, yes - require FTPS or SFTP and refuse plain logins. On a closed trusted LAN you may keep plain FTP for a legacy device that supports nothing else, but isolate that device and understand the password is visible on that network.

Why does FileZilla say insecure server

That message means the connection is plain FTP without TLS. Change the encryption setting to require FTP over TLS for FTPS, or switch the protocol to SFTP with port 22. Do not save a plain profile and click through the warning.

This guide is based on the Technical Anshu video - Install Cerberus FTP Server in 5 Minutes - Stuck on a step, ask in the video comments and you will get an answer there