GEN Virtual Private supports FTPS for file transfers. lftp is a command line tool for automating such transfers. Example:

lftp -u 'FTPS_USERNAME,FTPS_PASSWORD' \
  -e "set ftp:ssl-force true; set ftp:ssl-protect-data true; ls; bye" \
  ftp://ftps.example.invalid

Remember;  exposing password on the command line should be discouraged because it may be recorded in shell history, logs or the operating system's process list.

How the command works

• lftp starts the command-line file-transfer client.
• -u 'FTPS<em>USERNAME,FTPS</em>PASSWORD' supplies the username and password.
• The comma separates the username from the password.
• Quoting the value prevents the shell from interpreting special characters.
• -e "..." tells lftp to run a series of commands after connecting.
• set ftp:ssl-force true requires TLS for the FTP connection. The connection fails rather than falling back to unencrypted FTP.
• set ftp:ssl-protect-data true encrypts file listings and transferred file data as well as the authentication session.
• ls lists the files in the server's current remote directory.
• bye closes the connection when the preceding commands have completed.
• ftp://ftps.example.invalid identifies the FTP server. Using an ftp:// URL is correct for explicit FTPS because TLS is negotiated after the initial FTP connection.

This is different from SFTP, which runs over SSH and normally uses an sftp:// URL on port 22. FTPS commonly uses port 21 for explicit TLS.

Certificate verification *should* also be explicitly enabled in automated commands:

lftp -u 'FTPS_USERNAME,FTPS_PASSWORD' \
  -e "set ftp:ssl-force true; set ftp:ssl-protect-data true; set ssl:verify-certificate true; ls; bye" \
  ftp://ftps.example.invalid

Do not disable certificate verification to work around certificate errors. Install or update the system CA certificates and ensure that the hostname matches the server certificate.

Downloading directories with mirror

The mirror command copies a remote directory to a local directory, or visa-versa. 

lftp -u 'FTPS_USERNAME,FTPS_PASSWORD' \
  -e "set ftp:ssl-force true; set ftp:ssl-protect-data true; set ssl:verify-certificate true; mirror --verbose /remote/directory /local/directory; bye" \
  ftp://ftps.example.invalid

The arguments are:

mirror [options] REMOTE_DIRECTORY LOCAL_DIRECTORY

For example, to download the contents of a remote website directory:

lftp -u 'FTPS_USERNAME,FTPS_PASSWORD' \
  -e "set ftp:ssl-force true; set ftp:ssl-protect-data true; set ssl:verify-certificate true; mirror --verbose --continue /public_html /srv/backups/public_html; bye" \
  ftp://ftps.example.invalid

Useful download options include:

• --verbose — displays transferred files.
• --continue — resumes partially transferred files where possible.
• --only-newer — transfers files only when the remote copy is newer.
• --parallel=4 — uses up to four concurrent transfers.
• --delete — removes local files that do not exist remotely.

A typical incremental download is:

lftp -u 'FTPS_USERNAME,FTPS_PASSWORD' \
  -e "set ftp:ssl-force true; set ftp:ssl-protect-data true; set ssl:verify-certificate true; mirror --verbose --continue --only-newer --parallel=4 /public_html /srv/backups/public_html; bye" \
  ftp://ftps.example.invalid

Use --delete carefully because it can permanently remove files from the destination:

lftp -u 'FTPS_USERNAME,FTPS_PASSWORD' \
  -e "set ftp:ssl-force true; set ftp:ssl-protect-data true; set ssl:verify-certificate true; mirror --verbose --delete /public_html /srv/mirrors/public_html; bye" \
  ftp://ftps.example.invalid

Uploading directories with mirror

Use --reverse, or its short form -R, to copy a local directory to the remote server:

lftp -u 'FTPS_USERNAME,FTPS_PASSWORD' \
  -e "set ftp:ssl-force true; set ftp:ssl-protect-data true; set ssl:verify-certificate true; mirror --reverse --verbose --continue /local/directory /remote/directory; bye" \
  ftp://ftps.example.invalid

For example:

lftp -u 'FTPS_USERNAME,FTPS_PASSWORD' \
  -e "set ftp:ssl-force true; set ftp:ssl-protect-data true; set ssl:verify-certificate true; mirror -R --verbose --continue --only-newer /srv/website /public_html; bye" \
  ftp://ftps.example.invalid

When using reverse mirroring, --delete deletes remote files that do not exist in the local source. It should only be used when the remote directory is intended to be an exact copy of the local directory.

Safer unattended authentication

Including a password directly in the command is unsuitable for scheduled automation because it may be visible in shell history or process listings. Store the credentials in the account's ~/.netrc file instead:

machine ftps.example.invalid
login FTPS_USERNAME
password FTPS_PASSWORD

Restrict access to the file:

chmod 600 ~/.netrc

The automated command can then omit -u:

lftp -e "set ftp:ssl-force true; set ftp:ssl-protect-data true; set ssl:verify-certificate true; mirror --verbose --continue /public_html /srv/backups/public_html; bye" \
  ftp://ftps.example.invalid

For a scheduled job, ensure that ~/.netrc belongs to the operating-system account running the job and that the destination directory is writable by that account. Redirecting output to a protected log is also useful:

lftp -e "set ftp:ssl-force true; set ftp:ssl-protect-data true; set ssl:verify-certificate true; mirror --verbose --continue /public_html /srv/backups/public_html; bye" \
  ftp://ftps.example.invalid \
  >> /var/log/ftps-mirror.log 2>&1