---
title: "FTP"
sidebar_label: "FTP"
sidebar_position: 1
description: "How to access storage via the FTP protocol, how to connect and work with storage via FTP"
---

import Formbricks from '@theme/MDXComponents/Formbricks'
import {CustomTable} from '@selectel/docux/components'
import Tabs from '@theme/Tabs'
import TabItem from '@theme/TabItem'
import {TabItemLabel} from '@selectel/docux/components'

# FTP

:::info

FTP access is only available for buckets in [pools](/infrastructure/locations.mdx#pool) ru-1 and ru-7.

When working with buckets, you must use TLS/SSL Explicit encryption (TLS/SSL Explicit encryption).

:::

The FTP protocol uses two connections:

* a control connection — this is used to transmit commands and responses, which are text strings;
* a data transfer connection.

S3 uses only passive data transfer mode. The connection establishment and data transfer process is initiated exclusively from the client side.

Appends to files are not supported — when attempting to do so, a 426 response code will be returned.

## Connection data \{#access-data}

To connect to S3 via FTP, use:

* [FTP host](/s3/manage/domains.mdx#ftp-host) in the required pool;
* port 21 (control port);
* port range 10100-12000 (data ports).

Authentication is performed using an S3 key — [Account Owner](/access-control/user-types.mdx#account-owner) or a user with the [`iam.admin`](/access-control/role-reference.mdx#iam-admin) role must [issue a key](/access-control/manage/edit-user-data-or-role.mdx#issue-s3-key) to the service user. When connecting via FTP, the **Access key** and **Secret key** from the key are used as the username and password, respectively.

## Configure FTP

1. [Configure S3 access](#configure-s3-access).
2. [Connect via FTP](#connect-via-ftp).

### 1. Configure access to S3 \{#configure-s3-access}

Access can be configured by the [Account Owner](/access-control/user-types.mdx#account-owner) or a user with the [`iam.admin`](/access-control/role-reference.mdx#iam-admin) role.

1. [Create a service user](/access-control/manage/add-user.mdx#add-service-user) with a [role that provides S3 access](/s3/about/manage-access.mdx#access-within-roles), excluding the [`s3.bucket.user`](/access-control/role-reference.mdx#s3-bucket-user) role — FTP connection will not work with it.

   If you are using a service user with the [`s3.user`](/access-control/role-reference.mdx#s3-user) or [`object_storage_user`](/access-control/role-reference.mdx#object-storage-user) role, a [bucket policy](/s3/buckets/bucket-policy/) must be configured in the bucket, and its [rules](/s3/buckets/bucket-policy/about-bucket-policy.mdx#rules) must allow access to this user.
2. [Issue an S3 key to the user](/access-control/manage/edit-user-data-or-role.mdx#issue-s3-key).

### 2. Connect via FTP \{#connect-via-ftp}

To connect via FTP, you can only use clients that support secure connections via TLS/SSL (FTPS).

<Tabs queryString="os">
  <TabItem value="windows" default>
    <TabItemLabel>
      Windows
    </TabItemLabel>

    <Tabs queryString="win-tool">
      <TabItem value="total-commander" default>
        <TabItemLabel>
          Total Commander
        </TabItemLabel>

        1. Open Total Commander.
        2. In the **Net** menu, select **Connect to FTP server**.
        3. Click **Add**.
        4. On the **General** tab in the **Session** field, enter any name (e.g., Selectel).
        5. In the **Host name** field, enter the [FTP host](/s3/manage/domains.mdx#ftp-host) in the required pool.
        6. Select the **SSL/TLS** checkbox.
        7. In the **Account** field, enter the value of the **Access key** field from the [S3 key](#configure-s3-access).
        8. In the **Password** field, enter the value of the **Secret key** field from the S3 key.
        9. Select the **Passive mode (like Web browser)** checkbox.
        10. Open the **Advanced** tab.
        11. In the **Encoding** field, select **UTF-8**.
        12. Click **OK**. The profile will be saved.
        13. Click **Connect**.
      </TabItem>

      <TabItem value="far-manager">
        <TabItemLabel>
          FAR Manager
        </TabItemLabel>

        1. Open FAR Manager.

        2. To open the navigation menu:

           * for the left panel — press **Alt + F1**;
           * for the right panel — press **Alt + F2**.

        3. In the navigation menu, select **NetBox**.

        4. Press **Enter**.

        5. Press **Shift + F4**. The new connection creation screen will open.

        6. In the **File Protocol** field, select **FTP**.

        7. In the **Encryption** field, select **TLS/SSL Explicit encryption**.

        8. In the **Host name** field, enter the [FTP host](/s3/manage/domains.mdx#ftp-host) in the required pool.

        9. In the **Port number** field, enter `21`.

        10. In the **User name** field, enter the value of the **Access key** field from the [S3 key](#configure-s3-access).

        11. In the **Password** field, enter the value of the **Secret key** field from the S3 key.

        12. Click **OK**.

        13. Select the created profile.

        14. Press **Enter**.
      </TabItem>

      <TabItem value="winscp">
        <TabItemLabel>
          WinSCP
        </TabItemLabel>

        1. Open WinSCP.
        2. In the **File protocol** field, select **FTP**.
        3. In the **Encryption** field, select **TLS/SSL Explicit encryption (TLS/SSL Explicit encryption)**.
        4. Enter the host name — the [FTP host](/s3/manage/domains.mdx#ftp-host) in the required pool.
        5. In the **Port number** field, enter `21`.
        6. Enter the user name—the value of the **Access key** field from the [S3 key](#configure-s3-access).
        7. Enter the password — the value of the **Secret key** field from the S3 key.
        8. Click **Advanced**.
        9. Select the **Environment** section.
        10. In the **UTF-8 encoding for filenames** field, select **On**.
        11. Click **OK** → **Save**.
        12. Enter a connection name.
        13. If you want to save the password, select the **Store password** checkbox.
        14. Optional: select the **Create desktop shortcut** checkbox.
        15. Click **OK** → **Login**.
      </TabItem>

      <TabItem value="filezilla">
        <TabItemLabel>
          FileZilla
        </TabItemLabel>

        1. Open FileZilla.
        2. In the **File** menu, select **Site Manager**.
        3. Click **New site**.
        4. On the **General** tab in the **Host** field, enter the [FTP host](/s3/manage/domains.mdx#ftp-host) in the required pool.
        5. In the **Port** field, enter `21`.
        6. In the **Encryption** field, select **Require explicit FTP over TLS (explicit)**.
        7. In the **Logon Type** field, select **Normal**.
        8. In the **User** field, enter the value of the **Access key** field from the [S3 key](#configure-s3-access).
        9. In the **Password** field, enter the value of the **Secret key** field from the S3 key.
        10. Open the **Transfer Settings** tab.
        11. In the **Transfer mode** field, select **Passive**.
        12. Open the **Character set** tab.
        13. Select the **Force UTF-8** character set.
        14. Click **OK**.
        15. In the **Transfer** menu, select **Transfer type** → **Binary**.
        16. In the **File** menu, select **Site Manager**.
        17. Select the created site.
        18. Click **Connect**.
      </TabItem>
    </Tabs>
  </TabItem>

  <TabItem value="linux">
    <TabItemLabel>
      Linux
    </TabItemLabel>

    <Tabs queryString="lin-tool">
      <TabItem value="nautilus" default>
        <TabItemLabel>
          Nautilus
        </TabItemLabel>

        1. Open any directory using Nautilus.
        2. In the **File** menu, select **Connect to Server**.
        3. In the **Server Address** field, enter `ftps://<ftp_host>`. Specify `<ftp_host>` — the [FTP host](/s3/manage/domains.mdx#ftp-host) in the required pool.
        4. Click **Connect**.
        5. Select **Registered user**.
        6. Enter the login—the value of the **Access key** field from the [S3 key](#configure-s3-access).
        7. Enter the password — the value of the **Secret key** field from the S3 key.
        8. Optional: select the **Remember forever** checkbox.
        9. Click **Connect**.
      </TabItem>

      <TabItem value="filezilla">
        <TabItemLabel>
          FileZilla
        </TabItemLabel>

        1. Open FileZilla.
        2. In the **File** menu, select **Site Manager**.
        3. Click **New site**.
        4. On the **General** tab in the **Host** field, enter the [FTP host](/s3/manage/domains.mdx#ftp-host) in the required pool.
        5. In the **Port** field, enter `21`.
        6. In the **Encryption** field, select **Require explicit FTP over TLS (explicit)**.
        7. In the **Logon Type** field, select **Normal**.
        8. In the **User** field, enter the value of the **Access key** field from the [S3 key](#configure-s3-access).
        9. In the **Password** field, enter the value of the **Secret key** field from the S3 key.
        10. Open the **Transfer Settings** tab.
        11. In the **Transfer mode** field, select **Passive**.
        12. Open the **Character set** tab.
        13. Select the **Force UTF-8** character set.
        14. Click **OK**.
        15. In the **Transfer** menu, select **Transfer type** → **Binary**.
        16. In the **File** menu, select **Site Manager**.
        17. Select the created site.
        18. Click **Connect**.
      </TabItem>
    </Tabs>
  </TabItem>
</Tabs>

## Working with FTP \{#working-with-ftp}

### Authorization \{#authorization}

<CustomTable>
  <table data-sticky>
    <thead>
      <tr>
        <th>Command</th><th>Arguments</th><th>Description</th>
      </tr>
    </thead>

    <tbody>
      <tr>
        <th>USER</th><td>Access key from S3 key</td><td>Transfer username</td>
      </tr>

      <tr>
        <th>PASS</th><td>Secret key from S3 key</td><td>Transfer password</td>
      </tr>
    </tbody>
  </table>
</CustomTable>

### Security \{#protection}

<CustomTable>
  <table data-sticky>
    <thead>
      <tr>
        <th>Command</th><th>Arguments</th><th>Description</th>
      </tr>
    </thead>

    <tbody>
      <tr>
        <th>AUTH</th><td>Not required</td><td>Establish a secure TLS connection. Arguments will be ignored</td>
      </tr>

      <tr>
        <th>PROT</th><td>P / C</td><td>Set protection mode. P for Private, C for Clean. By default, P will use TLS</td>
      </tr>

      <tr>
        <th>PBSZ</th><td>Buffer size</td><td>Set the protection buffer size. The server will respond with 200 OK</td>
      </tr>
    </tbody>
  </table>
</CustomTable>

### Misc \{#other}

<CustomTable>
  <table data-sticky>
    <thead>
      <tr>
        <th>Command</th><th>Arguments</th><th>Description</th>
      </tr>
    </thead>

    <tbody>
      <tr>
        <th>FEAT</th><td>Not required</td><td>Display a list of supported additional functions</td>
      </tr>

      <tr>
        <th>SYST</th><td>Not required</td><td>Display the server operating system</td>
      </tr>

      <tr>
        <th>NOOP</th><td>Not required</td><td>No operation; the server will respond with 200 OK</td>
      </tr>

      <tr>
        <th>OPTS</th><td>As per RFC2389</td><td>Transfer additional options to the server</td>
      </tr>
    </tbody>
  </table>
</CustomTable>

### File access \{#access-to-files}

<CustomTable>
  <table data-sticky>
    <thead>
      <tr>
        <th>Command</th><th>Arguments</th><th>Description</th>
      </tr>
    </thead>

    <tbody>
      <tr>
        <th>SIZE</th><td>Filename</td><td>Get file size</td>
      </tr>

      <tr>
        <th>STAT</th><td>Not required</td><td>Get connection statistics</td>
      </tr>

      <tr>
        <th>MDTM</th><td>Path</td><td>Get the file modification date and time</td>
      </tr>

      <tr>
        <th>RETR</th><td>Filename</td><td>Download a file. Works only after switching to passive mode using the PASV command. Resuming downloads is supported</td>
      </tr>

      <tr>
        <th>STOR</th><td>Filename</td><td>Upload a file in passive mode</td>
      </tr>

      <tr>
        <th>APPE</th><td>Filename</td><td>Tell the server to accept a remote file. The command will work only if the file does not already exist in storage. If the file exists, an error will be returned</td>
      </tr>

      <tr>
        <th>DELE</th><td>Filename</td><td>Delete a file</td>
      </tr>

      <tr>
        <th>RNFR</th><td>Filename</td><td>Select file for renaming</td>
      </tr>

      <tr>
        <th>RNTO</th><td>New filename</td><td>Set a new filename. Only after a file has been selected with the RNFR command</td>
      </tr>

      <tr>
        <th>ALLO</th><td>Size in bytes</td><td>Return a response regarding available space. Regardless of the argument, the response will be 202 OK</td>
      </tr>

      <tr>
        <th>REST</th><td>Offset in bytes</td><td>Command to “rewind” to a specific position in a file. Required for resuming downloads using RETR</td>
      </tr>
    </tbody>
  </table>
</CustomTable>

### Working with buckets \{#working-with-buckets}

<CustomTable>
  <table data-sticky>
    <thead>
      <tr>
        <th>Command</th><th>Arguments</th><th>Description</th>
      </tr>
    </thead>

    <tbody>
      <tr>
        <th>CWD</th><td>Directory name</td><td>Change to the specified directory</td>
      </tr>

      <tr>
        <th>PWD</th><td>Not required</td><td>Show the current working directory</td>
      </tr>

      <tr>
        <th>CDUP</th><td>Not required</td><td>Go to the parent directory</td>
      </tr>

      <tr>
        <th>NLST</th><td>Not required</td><td>Return a directory file list in a more concise format than LIST. Only in passive connection mode</td>
      </tr>

      <tr>
        <th>LIST</th><td>Path</td><td>Display contents of the current or provided directory. Both relative and absolute paths are supported</td>
      </tr>

      <tr>
        <th>MLSD</th><td>Path</td><td>Display contents of the current directory. The main difference from LIST relates to timestamps with one-second precision; time is specified in UTC</td>
      </tr>

      <tr>
        <th>MKD</th><td>Directory name</td><td>Create a directory</td>
      </tr>

      <tr>
        <th>RMD</th><td>Directory name</td><td>Delete a directory</td>
      </tr>
    </tbody>
  </table>
</CustomTable>

### Establishing a connection \{#establishing-connection}

<CustomTable>
  <table data-sticky>
    <thead>
      <tr>
        <th>Command</th><th>Arguments</th><th>Description</th>
      </tr>
    </thead>

    <tbody>
      <tr>
        <th>TYPE</th><td>A / I</td><td>Change data transfer mode. There are two options: ASCII (A) or Binary (I). Any argument is ignored; the command is used for backward compatibility. Only Binary mode is supported</td>
      </tr>

      <tr>
        <th>PASV</th><td>Not required</td><td>Switch to passive data transfer mode</td>
      </tr>

      <tr>
        <th>EPSV</th><td>Not required</td><td>Initiate a data transfer connection in passive mode. The server will respond with the connection port number</td>
      </tr>

      <tr>
        <th>EPRT</th><td>Protocol version / address / port</td><td>Initiate a data transfer connection. The command is exclusively for active data transfer mode, so for this command, the server will report that active mode is not supported</td>
      </tr>

      <tr>
        <th>PORT</th><td>Not required</td><td>Switch to active data transfer mode. The command is exclusively for active data transfer mode, so for this command, the server will report that active mode is not supported</td>
      </tr>

      <tr>
        <th>QUIT</th><td>Not required</td><td>Disconnect from the server</td>
      </tr>
    </tbody>
  </table>
</CustomTable>

<Formbricks />