Q:

Security implications of not reusing SSL session in FTPS

I've just run into a problem with our FTPS server refusing connections due to missing SSL session reuse. Our client actually should reuse them, but it just doesn't work. I'm well aware that it's not good for performance, but with currently tens of connections per hour, it has a very low priority.
So I solved it by configuring ProFTPd using
TLSOptions NoSessionReuseRequired

I wonder, are there any security implications?

A:

There are potential issues with disabling session resumption for PASV mode FTP. These issues are solved by session resumption as it allows the server to know that the party that initiated the connection is the same one who is now transmitting data (as PASV mode uses multiple ports).
In general however, there are no security implications for disabling session resumption, although it will put a higher load on the server if it has to do a complete TLS handshake for each connection, especially if there are many connections. Its only purpose is to reduce connection latency.
There are two types of session resumption:

Session identifiers are the original technique for implementing session resumption. These identifiers are unique values a server gives to each client. The server will store the session information alongside the session identifier. When the client connects a second time, it presents the server with the session ID, and the server will resume the session.
Session tickets are an encrypted blob of data containing information about the session that the server gives to clients. The clients will cache this ticket and will send it to the server next time it connects. The server now only has to store the key to decrypt the ticket. This is similar to a session ID, but rather than the server storing each per-client session, the server offloads this storage to the client. This is the most common form of session resumption.

TLS 1.3 will additionally add a new type of session resumption, called 0-RTT.

