How can I anonymize my FTP traffic using the Tor network?

Question

I want to make my ftp server visible only from Tor side.

Answer 1

In regard to the server requirements, there are a few important differences between a hidden FTP service and a regular FTP service. Also, you should check your ftp server software to make sure it doesn't leak your IP address.

1. Force the client to use passive mode, not active/port mode. In passive mode the client initiates both the control and the data connection. In active mode, the server initiates the data connection. See here for more details. (I think it'd be hard to support active mode, because from the perspective of the ftp server, the client is connecting from localhost, so when the server makes the data connection to the client it will try to connect to localhost. You'd need some serious magic to intercept and redirect that connection, through tor, and to the client's .onion address. So to keep things easy, stick with passive mode.)

2. To establish the data connection, the server will pick a new port and tell the client to connect to the server at that port. Since tor needs to know about that port range, you'll need to configure the ftp server to use a predefined port range and then add each of the port numbers in that range to a HiddenServicePort directive.

3. RFC 959 specifies that the server send the IP address and port number when soliciting a passive mode data connection. Since, from the perspective of the server, the client is localhost, this IP address should be 127.0.0.1. If you configure your ftp server to only bind to the loopback address, then you can be reasonably sure that the server won't send your public IP to the client. If you're paranoid, you can use a tool like strace to check.

   1707  write(0, "227 Entering Passive Mode (127,0,0,1,7,208).\r\n", 46 <unfinished ...>
   

Here is a concrete example using CentOS 6 and vsftpd (check vsftpd docs here).

1. Install vsftpd (yum install -y vsftpd)
2. Disable active mode by appending port_enable=NO to /etc/vsftpd/vsftpd.conf
3. Make sure that vsftpd only binds to localhost, not your public IP address. Append listen_address=127.0.0.1 to vsftpd.conf. For additional safety, reject/drop the ftp port and your chosen data ports at your firewall.
4. Force vsftpd to use certain ports for the data connection, by appending these two params to vsftpd.conf: pasv_max_port=2000 and pasv_min_port=2000.
5. Enable and start vsftpd. (chkconfig vsftpd on; service vsftpd start)
6. Test the ftp server by making a local connection. You might have to temporarily disable SElinux (setenforce 0)

7. Configure the FTP service in tor

   HiddenServiceDir /var/lib/tor/ftp-service/
   HiddenServicePort 21
   HiddenServicePort 2000
   

   (you may want to use more than one data port if you expect to support multiple clients at the same time.)

8. Restart Tor. (service tor restart)

9. Check /var/lib/tor/ftp-service/hostname for the hostname of your hidden service.
10. Use the tor browser bundle to connect to the hidden ftp service. The Tor wiki talks about it here.

Answer 2

You have to make your FTP server a hidden service. In your torrc, you have to specify:

HiddenServiceDir HSDIR
HiddenServicePort  VIRTPORT HSADDRESS:HSPORT

HSDIR is a directory where HS key/data gets stored. Must be r+w for Tor and, as far as I know, by nobody else. VIRTPORT is the port that clients connect to on your onion address. (You can find your onion address in the directory you specified as HSDIR.)

HSADDRESS:HSPORT the address:port where your HS actually listens. You may omit these. By default, this is 127.0.0.1 (same host as your Tor relay) and the port is the same as VIRTPORT.

See the Tor Manual on hidden services.. Note that this example uses a web server, not an FTP server, but the process is the same.

EDIT: (Because of weasel's comment) - Because of the way the FTP protocol works with setting up data connections, I think it may not be compatible with Tor at all..