I want to make my ftp server visible only from Tor side.

  • Do you mean that the FTP server should be accessible only over the Tor network and not over the open Internet? – pabouk Dec 16 '13 at 14:19

In regard to the server requirements, there are a few important differences between a hidden FTP service and a regular FTP service. Also, you should check your ftp server software to make sure it doesn't leak your IP address.

  1. Force the client to use passive mode, not active/port mode. In passive mode the client initiates both the control and the data connection. In active mode, the server initiates the data connection. See here for more details. (I think it'd be hard to support active mode, because from the perspective of the ftp server, the client is connecting from localhost, so when the server makes the data connection to the client it will try to connect to localhost. You'd need some serious magic to intercept and redirect that connection, through tor, and to the client's .onion address. So to keep things easy, stick with passive mode.)

  2. To establish the data connection, the server will pick a new port and tell the client to connect to the server at that port. Since tor needs to know about that port range, you'll need to configure the ftp server to use a predefined port range and then add each of the port numbers in that range to a HiddenServicePort directive.

  3. RFC 959 specifies that the server send the IP address and port number when soliciting a passive mode data connection. Since, from the perspective of the server, the client is localhost, this IP address should be If you configure your ftp server to only bind to the loopback address, then you can be reasonably sure that the server won't send your public IP to the client. If you're paranoid, you can use a tool like strace to check.

    1707  write(0, "227 Entering Passive Mode (127,0,0,1,7,208).\r\n", 46 <unfinished ...>

Here is a concrete example using CentOS 6 and vsftpd (check vsftpd docs here).

  1. Install vsftpd (yum install -y vsftpd)
  2. Disable active mode by appending port_enable=NO to /etc/vsftpd/vsftpd.conf
  3. Make sure that vsftpd only binds to localhost, not your public IP address. Append listen_address= to vsftpd.conf. For additional safety, reject/drop the ftp port and your chosen data ports at your firewall.
  4. Force vsftpd to use certain ports for the data connection, by appending these two params to vsftpd.conf: pasv_max_port=2000 and pasv_min_port=2000.
  5. Enable and start vsftpd. (chkconfig vsftpd on; service vsftpd start)
  6. Test the ftp server by making a local connection. You might have to temporarily disable SElinux (setenforce 0)
  7. Configure the FTP service in tor

    HiddenServiceDir /var/lib/tor/ftp-service/
    HiddenServicePort 21
    HiddenServicePort 2000

    (you may want to use more than one data port if you expect to support multiple clients at the same time.)

  8. Restart Tor. (service tor restart)

  9. Check /var/lib/tor/ftp-service/hostname for the hostname of your hidden service.
  10. Use the tor browser bundle to connect to the hidden ftp service. The Tor wiki talks about it here.
  • great! thats all I need – krang Dec 17 '13 at 6:29
  • 1
    I had difficulty getting a FTP server to work well behind Tor. I settled on using SFTP instead (FTP over SSH). – Manas B Dec 19 '13 at 21:25
  • Has anyone ever actually tried this? Here's what I'm imagining happens: The client connects, enables passive mode, the server says "connect to the data port at :", the client tries to use the SOCKS proxy to connect to on port 200, IE, itself. Tor rejects the connection to a local address and the negotiation fails. This will never work. – cacahuatl Mar 24 '17 at 16:44

You have to make your FTP server a hidden service. In your torrc, you have to specify:

HiddenServiceDir HSDIR

HSDIR is a directory where HS key/data gets stored. Must be r+w for Tor and, as far as I know, by nobody else. VIRTPORT is the port that clients connect to on your onion address. (You can find your onion address in the directory you specified as HSDIR.)

HSADDRESS:HSPORT the address:port where your HS actually listens. You may omit these. By default, this is (same host as your Tor relay) and the port is the same as VIRTPORT.

See the Tor Manual on hidden services.. Note that this example uses a web server, not an FTP server, but the process is the same.

EDIT: (Because of weasel's comment) - Because of the way the FTP protocol works with setting up data connections, I think it may not be compatible with Tor at all..

  • 1
    Have you tested this? Have you actually transferred files (or directory listings) using this? – weasel - Peter Palfrader Dec 15 '13 at 16:27
  • 1
    Good call @weasel-PeterPalfrader. I had tested this before with services for http, smtp, pop, but not ftp. I see how setting up a data connection would at best just not work or at worst go outside Tor. – Jobiwan Dec 15 '13 at 17:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.