Connecting over LAN to FileZilla Server with SSL/TLS

[andhaa]

Hello,
I have installed Filezilla Server on Windows 7 in a LAN with SSL/TLS settings enabled. Inside my LAN one of the user has installed Filezilla Client and he can easily connect to FTP server and download files. Rest of users don't have Filezilla Client installed on their machines (OS installed Windows 7), how can they access Filezilla Server over the LAN using Command Line for SSL/TLS settings?

Note: Previously over the LAN users used to connect using command prompt with following command:
ftp <name of server:port>

Now they get following error:
ftp <name of server:port>
Connected to IP Address
220-FileZilla Server version 0.941 beta
220-written by Tim Kisse (Tim.Kosse@gmx.de)
220 Please visit http://sourceforge.net/projects/filezilla/
User: xxxxx
530 Have to use explicit SSL/TLS before loggin on.
Login failed.

[botg]

ftp.exe doesn't support FTP over TLS. You need to use a far more modern FTP client, one that isn't stuck in the early 80's in terms of features

[boco]

Before you ask: No, browser cannot use FTP over TLS, either? Firefox has the FireFTP extension, this one can.

[xeon]

Before you ask: No, browser cannot use FTP over TLS, either? Firefox has the FireFTP extension, this one can.

FireFTP doesn't even support session reuse. Not sure about most servers, but vsftpd (by default) doesn't even allow data connections to be made without it.

http://scarybeastsecurity.blogspot.com/ ... eased.html

[botg]

Indeed, session reuse is much needed for FTP over TLS to be secure. I wonder whether I should enforce it in FileZilla Server as well.

[xeon]

Indeed, session reuse is much needed for FTP over TLS to be secure. I wonder whether I should enforce it in FileZilla Server as well.

Most FTP clients I've seen don't support it. I tested several dozen different ones awhile back and only 5 supported it.

[boco]

@botg: Do you have an RFC I can smack the developers of my favorite server with?

I wonder whether I should enforce it in FileZilla Server as well.

Could at least modify a few replies' text to contain a warning if an insecure client is detected.

[botg]

@botg: Do you have an RFC I can smack the developers of my favorite server with?

Sadly no. I'll see if I can find some alternative information, e.g. some research papers or so stressing the importance of session reuse.