FTP, SSH, SMTP, IMAP

FTP (File Transfer Protocol) predates casual encryption. Control conventionally listens on TCP/21. Commands such as USER and PASS, and often the files themselves, travel as readable text on the path — the same class of failure as HTTP/80. FTP also splits control and data into separate connections (active vs passive), which is why FTP is a firewall headache: extra ports, extra state, extra ways to get it wrong. You do not need a steal-the-password script to understand the risk. If the bytes are cleartext, an observer on a path you should not be observing could read them. In this course you will not capture other people's FTP, will not write attack tooling, and will not "practice" against random FTP banners on the internet. SFTP is not "FTP with an S slapped on." SFTP is a file protocol inside an SSH session, typically TCP/22. FTPS (FTP plus TLS) exists too, still with FTP's dual-connection awkwardness. When a modern runbook says "put the file on the box," the default should be scp/sftp over SSH keys, not a 1990s FTP daemon with a password.

SSH (Secure Shell) encrypts remote login, remote commands, and tunneled file copy. Port 22/TCP is the well-known listener. The confidentiality win versus telnet/FTP is the point of the protocol: the path sees ciphertext. The remaining failures are human and operational: password auth facing the whole internet, reused credentials, and private keys treated like chat snippets. A key pair is two files. The public key is a lock you may copy to a server's authorized_keys. The private key is the unique cut; mode 600; never pasted into Slack, tickets, or a lesson chat. Anyone with that file is you. Host key verification (known_hosts) still matters: a changed fingerprint is a stop sign, not a yes-spam. Only connect to systems you own or have written permission to administer. A listening 22 on 0.0.0.0 is a door to the LAN and beyond; 127.0.0.1:22 would be a local-only door — rare, but the bind address is the first fact.

Email is two jobs that people smash together. SMTP (Simple Mail Transfer Protocol) injects and relays messages between mail systems. IMAP (and POP3) is how a client reads and organizes a mailbox that already exists. You cannot delete SMTP from the universe by using a webmail UI: when you send to a friend at another domain, some SMTP conversation still happens between servers. That is why mail still uses SMTP. Port 25/TCP is classic server-to-server relay. Many consumer ISPs block outbound 25 to cut spam. Port 587/TCP is submission: a person (or app) authenticates to their provider and hands over a message, usually with STARTTLS. Port 465 is SMTPS (implicit TLS) on some providers. Open relays — servers that forward mail from strangers — are how 25 became a spam cannon. SPF, DKIM, and DMARC are receiver-side checks on "who is allowed to send as this domain." They are not IMAP features.

IMAP keeps mail on the server and syncs folders across devices. Port 143/TCP is historically cleartext IMAP (LOGIN as readable as FTP USER/PASS). Port 993/TCP is IMAPS — IMAP over TLS. Prefer 993. POP3 (110/995) downloads to one device; you will see it in old tickets. A mailbox password on 143 is another postcard. Encrypted ports do not remove phishing: SMTP will still happily relay a convincing message. Protocol encryption and message authenticity are different layers — same lesson as HTTPS vs "the site is honest."

ss -tuln is local socket inventory. -t TCP, -u UDP, -l listening, -n numeric (no extra DNS lookups). You are reading your kernel's table. That is not nmap. You will not target other IPs. If you see :22 or :80, ask: which address? *:22 or 0.0.0.0:22 is all IPv4 interfaces; 127.0.0.1 is this host only. curl -I is optional header hygiene from the last lesson — still example.com or a host you own.

# Listening TCP/UDP on THIS machine (not a network scan)
ss -tuln

# Easier to read: only LISTEN lines
ss -tuln | grep -E 'LISTEN|udp'

# Optional notes — your home directory, mode 600
mkdir -p "$HOME/cyberlium-lab"
ss -tuln > "$HOME/cyberlium-lab/app-protocol-ports.txt"
chmod 600 "$HOME/cyberlium-lab/app-protocol-ports.txt"

# Optional: header check from the previous lesson (your client)
curl -I https://example.com | head -n 20

# Private keys: list names, never print contents
ls -l "$HOME/.ssh" 2>/dev/null || echo 'no ~/.ssh yet — that is OK'
# NEVER: cat id_ed25519  or  paste a private key into chat/tickets

# NEVER: nmap, masscan, or nc to other LAN hosts
# NEVER: stand up FTP "to capture passwords" — no exploit payloads in this course
# NEVER: connect SSH to a box you noticed in someone else's ARP table

You can separate FTP's cleartext control channel from SFTP-over-SSH, treat 22 as encrypted remote control that still dies if the private key leaks, and explain why SMTP remains the inter-domain mail truck while IMAPS (993) is how a client reads a mailbox. Next — Lab — Wireshark Packet Analysis — you will capture only your own interface or loopback and watch DNS, TLS, and HTTP as packets, never a café full of strangers.