Is ftp encrypted?
Okay, we know the drill: don't use FTP, use SFTP or FTPS.
But what exactly is the risk being posed? The files themselves are sent unencrypted, and this may be fine, or disastrous, depending on what the code in them contains. But, if we're dealing with static HTML files (or similar), presumably this is fine?
What about a user's credentials, password, etc.? Are these guarded when using vanilla FTP? And if so, is it "adequate"?
I'm asking quite honestly as a quality of life measure. My alternative for updating basic files on a public server would otherwise be with a messy process of SSH keys, etc. using systems which, for the life of them, cannot remember my password when sent via SFTP.
Granted the particular network that one is on is also of importance. A secure office network is a bit different from an airport lounge.
The answer to your question - Is ftp encrypted is -
Credentials are transferred in clear text, but you know that from the other posts. But how easy is it to get those details?
As an example I ran tcpdump and connected to an FTP server. Let's take a look at the pcap with strings:
220 (vsFTPd 3.0.2)
6USER joe
CT'X
331 Please specify the password.
CTXY
PASS superSecretPassword
230 Login successful.
What about the content of commands? Here is the output from the pcap:
PASV
227 Entering Passive Mode (192,168,1,2,238,178).
LIST
150 Here comes the directory listing.
MNt@
drwxr-xr-x 2 1000 1000 4096 Aug 28 20:27 Desktop
drwxr-xr-x 2 1000 1000 4096 Aug 28 20:27 Documents
drwxr-xr-x 2 1000 1000 4096 Aug 28 20:27 Downloads
drwxr-xr-x 2 1000 1000 4096 Aug 28 20:27 Music
-rw-rw-r-- 1 1000 1000 58677 Jun 12 2010 pic1.jpg
And if you want file content here is a get of the jpg.
200 Switching to Binary mode.
PASV
227 Entering Passive Mode (192,168,1,2,64,224).
RETR pic1.jpg
150 Opening BINARY mode data connection for pic1.jpg (58677 bytes).
JFIF
http://ns.adobe.com/xap/1.0/
" id="W5M0MpCehiHzreSzNTczkc9d"?>
x:xmptk="XMP Core 4.1.1">
xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">
So if someone could sniff packets on the client, server or network then you have a security issue. Mitigating the issue by moving the SFTP or similar is an easy and good idea.