{
  "port": 990,
  "protocol": "tcp",
  "service": "FTPS (implicit TLS control channel)",
  "oneLiner": "Implicit-TLS FTPS: the handshake starts the instant you connect, with no AUTH TLS command first.",
  "whatItIs": "A client connecting to 990 negotiates TLS immediately and only then speaks FTP commands, with file data on 989 or on passive high ports. This convention grew up in products rather than in the IETF and was never standardised; RFC 4217 specifies the other approach, explicit FTPS, where a normal session on port 21 issues AUTH TLS to upgrade in place. IANA still carries the ftps registration on 990, and managed-file-transfer servers and appliances keep offering it because older clients only know implicit mode. On a scan it marks a file-transfer server, usually sitting next to 21.",
  "exposure": {
    "verdict": "careful",
    "note": "TLS is mandatory here, so it does not leak credentials the way port 21 does, but it is still an authenticated file-transfer service with awkward data-channel and NAT behaviour. Expose it deliberately with a current TLS configuration, or prefer SFTP over SSH."
  },
  "checkCommand": "openssl s_client -connect TARGET:990 -quiet",
  "links": [
    {
      "title": "RFC 959 — File Transfer Protocol (FTP)",
      "url": "https://www.rfc-editor.org/rfc/rfc959.html",
      "kind": "spec"
    },
    {
      "title": "RFC 4217 — Securing FTP with TLS (the explicit alternative)",
      "url": "https://www.rfc-editor.org/rfc/rfc4217.html",
      "kind": "spec"
    },
    {
      "title": "IANA port registry — 990",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=990",
      "kind": "iana"
    },
    {
      "title": "ProFTPD source repository",
      "url": "https://github.com/proftpd/proftpd",
      "kind": "github"
    }
  ],
  "ianaName": "ftps"
}