I was wondering, because I need both my port 21 open on my router and my firewall for it to work, but then it seems as though it's wide open for attack. Is there any way I can keep it secure? Luckily, on my router I have port 21 open for only the computer that has the ftp server, so it's not compromising my entire network, just the ftp server. I have Windows XP, so it worries me even more because more attacks are made for XP, I'm sure.
FTP is a security risk because it transmits login information (including passwords) in plain/text, so you'll need to wrap it up in encryption. If you need to use FTP specifically, then OpenVPN can wrap it up very nicely for you in a fully encrypted stream:
OpenVPN (free and open source)
Your server and all clients that need to use your FTP server will then have to have OpenVPN installed.
Of course, you might find it easier to just use one of the more secure versions of FTP known as SFTP or FTPS since many FTP clients have built-in support for this. One really good one is FileZilla which supplies complete and independent client and server applications, and complies with the relevant RFCs:
FileZilla (free and open source)
There are numerous solutions to this problem, with various levels of complexity and convenience.
Best of luck!
FTP actually requires two ports, 21 is the main control port, and 20 is for data.
FTP is a weird protocol, it was created really early in the Internet days, before firewalls and security was thought of. As such, as designed, it sucks for firewalling.
The ftp server listens on port 21 for connections from a client. But data goes over another port. In 'classic' ftp, the server would open a connection from port 20 on the server to some ephemeral port on the client. Nowadays you can't do that, a connection from the server to a client would be blocked by a firewall, or be unavailable because of a client NAT.
In passive FTP, the server creates a new listening socket on some port for the client to connect to. Now you're trying to firewall some dynamically changing port.
That, and as others have mentioned the password is in plaintext, I'd strongly suggest http/https. It's much cleaner, unless you really need ftp. In that case, I'd only put things I'd be comfortable with anonymous ftp.