I want upload a file to a ftp server using Tor proxy to comunicate with a Hidden Service [Python 3]

Question

I have seen several ways using stem and socks but I could not connect to an FTP yet.

#!/usr/bin/python3.5
import ftplib 
import os 

def upload(ftp, file):

    ext = os.path.splitext(file)[1]
    if ext in(".txt", ".htm", ".html"):

        internet.ftp.storlines("STOR " + file ,open(file))
    else:
        internet.ftp.storbinary("STOR " + file, open(file, "rb"), 1024)

ftp = ftplib.FTP('jk5qbvzlgbmss3zh.onion')
ftp.login("proftpd","123123")

upload(ftp, "file.zip.gpg")

Answer 1

The tl;dr is that FTP and .onion do not go well together and never will, due to how the FTP protocol works. For more details, see below.

FTP goes a little like this:

• Client connects to the "command" channel.
• Client logs in to the "command" channel.
• Client asks for some data over the "command" channel.
• If you're using Active Mode:
  • Client opens up a listener port on their own computer and tells the server the IP and Port to connect to over the "command" channel.
  • Server connects to the client's "data" port, and sends the data.
• Else, if you're using Passive Mode:
  • Server opens up a high numbered port on it's own system, and tells the client the IP and Port over the "command" channel.
  • Client connects to the "data" port and receives the data.

Now, Active is always bad for Tor users, because as you can see the client has to tell the server it's IP address, revealing the users location (at least as accurately as the FTP client knows it). Passive however can be used over Tor without revealing the client IP...but consider the situation with onion services.

When you set up an onion service you specify a virtual port, mapped to some real listening port on your system. With FTP, the server will pick a high numbered port normally at random, or from some range. If you only set up port 21, then even if the client could negotiate, the onion service has no virtual port mapping for port used in the data channel, so the connection would never get through (in fact, by default trying to connect to this high numbered port on the onion would result in the circuit being closed). So, you'd need to get the FTP server to only use a limited set of ports for listening on data connections in passive mode. That's the first barrier.

The second barrier is that the FTP protocol deals explicitly in IP addresses, since there is no IP used in onion services the client and server can't communicate where to connect to retrieve data.

This feature of the FTP protocol, where they use distinct connections to keep commands and data separated, makes it incompatible with onion services without fundamental changes to the way in which FTP works.

Other problems might include that a malicious client who negotiates an active mode connection with the server can essentially tell the server to open a connection to an arbitrary location on the internet, how well have you ensured that the server cannot make connections outside of Tor where you could be deanonymized?

Instead, you should opt for using protocols like SFTP, the file sharing subsystem of SSH which doesn't have this particular problem and works fine with onion services on top of a lot of other advantages like actually being encrypted and authenticated, along with other advantages like public key based authentication mechanisms and more.