New Feature Explained-FTPS Only in AI New Firmware v3.1.0764

[Reolink Fiona]

Hi, FTP users,
 
If you have upgraded your AI camera with the latest firmware v3.1.0.764, you may find that there is a new button named “FTPS Only” when you configure the FTP.

 
In our new firmware, the camera supports the FTPS, the encrypted FTP. Uploading the file via the FTPS can better secure your uploading files.
 
How does this “FTPS only” button work?
Our camera always connects via FTPS first. If you enable “FTPS only”, the camera will only connect to the server via FTPS. If you disable this button, the camera will connect to the server via FTPS first. If your server doesn’t support FTPS, the camera will switch to plain FTP.
 
FTP test failed or upload failed
If you meet situations like FTP test failed or upload failed with this new firmware v3.1.0.764, you can try to check if your server supports FTPS. If your server supports FTPS, but it failed in the new firmware and succeeds in the old firmware, you can check if you have configured TLS on your FTP server. With the old firmware, you don’t need to configure TLS.
 
Some cameras can’t switch back to plain FTP after FTPS failed, this may be about the server encryption issue. In this situation, you can submit a ticket, and our tech will have a further check on this issue. Submit a request – Reolink Support
 
What can I do if I want the highest level of security not only for my account but also for files?
Besides enabling the "FTPS only", you need to force the camera to use "PROT P" on your server. But you should know that this may result in higher power consumption.
 
If you have any problems or suggestions, you can let me know.
 

[user_673503979577389_673503979577389]

@reolink-fiona
I just bought two reolink. Trackmix and duo 2 just to find out now that I have to think about sending them back. I have a Webhoster with 250gb unused space which I planned to use but who would expect that sftp is not supported by a modern camera producer. Very disappointing.

[reolink_476567443320997]

you need to force the camera to use "PROT P" on your server

How do you do that?

PROT subcommand is sent by FTP clients (Reolink camera), in FTPS mode the camera still sends `PROT C` (unencrypted data connection), which would simply get refused by FTP server requiring TLS on data connection when the camera tries to use the data connection. It seems like Reolink did not implement FTPS properly and created a false impression that the connection is encrypted but video / picture in FTPS mode is available for everyone to see, which is very bad.

[joseph_1979]

@reolink_476567443320997 Reolink camera starts FTP connections and then updates to FTPS using the AUTH command. If this is accepted the the camera establishes SSL connection using TLSv1.2 (ECDHE-RSA-AES256-GCM-SHA384), 256 bit encryption and after entering passive mode it sends the PROT P for a secured data channel. If, however, the FTP server is not able to upgrade from FTP to upgrade to TLS (explicit method) then connections fail.

Do you have the Wireshark trace which shows what you are stating? Can you share it?

Personally I would have opted for SFTP rather than FTPS......this is history now but of course more easy to implement.

[G2M Advisors_537747045552377]

This is good news but would you please consider adding support for the more common SFTP (Secure Shell File Transfer Protocol)?

[joseph_1979]

@g2m-advisors_537747045552377 I already forwarded this suggestion. The only reason I can see is that FTPS is easier to implement. SFTP offers better usability with firewalls as it uses one port while FTPS uses multiple ports. Have been working with lot of equipment from different suppliers and never used the FTPS.

Hopefully one day we shall see SFTP on both cameras and NVRs.