FTP through TOR - safely and successfully

Intro

This article is explaining how to use clearnet FTP servers through TOR socks proxy. For this project you need FTP client that supports socks proxies (most does), FTP server address and lots of patience.

Instructions

FTP over Tor can be dangerous because if not set correctly and even though you started FTP connection through TOR, your FTP client might be sending/receiving files without passing it through TOR chain!

To be safe as possible follow this instructions:

   1. MOST IMPORTANT for security reasons #1: you must set firewall rules for your FTP client to accept incoming and outgoing connections ONLY to&from: 127.0.0.1 (this is extremely important because if something else fails, this will save you), 

   2. important for security reasons (to double your protection): your machine should be connected through router making your machine unaware of your ISP IP, 

   3. technical requirement: you must set your ftp client to work in PASV or EPSV mode (usually must be done for each server individually!), 

   4. technical requirement: you must set SOCKS proxy in your ftp client (usually must be set and activated for each server individually!), 

Double IP problem or why most FTP connections through TOR fail?

FTP session is made through 2 connections with the server: first connection for commands (usually on port 21) and the other one for file transfers (data connection, on port number controlled by a client or a server depending on chosen transfer mode - active or passive). Command connection is started when you initiate connection from your FTP client to the server. Second connection (data connection) is initiating ONLY when you send request for actual file transfer and it will be closed after file transfer finishes (command port connection will stay on until you disconnect from the server). Since TOR is changing your exit IPs very often, those 2 connections could (not always) appear to the server as they are originating from two different IPs. In this case most FTP servers will not allow further communication, making your FTP client to fail even while retrieving directory list (that's how you can be sure that you are experiencing this double IP problem). To avoid this problem you must insure that all connections from your client FTP software are reaching to the FTP server from the same TOR exit point. To accomplish this check TOR command MapAddress or socksify your FTP client with setting additional non-TOR proxy into FTP client software (additional proxy is required to maintain the same exit IP).

Active vs. Passive mode and some explanations

In passive mode FTP client software initiate file transfer by opening additional port on the server making all file transfer to pass through TOR chain. In active mode after requesting file from the server, server initiate file transfer by opening additional port on a client's machine connecting to the client's IP directly (only in active mode, FTP client supplies local IP to the server - required by the FTP protocol itself).

If you are behind a router and if mistakenly started FTP in active mode, server will get only 127.0.0.1 as your IP making your real IP out of the server logs. Otherwise the server will get your real ISP IP and will try to contact your machine directly and bypassing TOR chain - but if you have set your firewall as mentioned above under #1 (to block all traffic except 127.0.0.1) server could not succeed into opening data port on your machine and you will be safe. Even though the server got your real IP it could not be an evidence on a court because server is getting IP from command line which originates from user's FTP software and that command line could easily be adjusted to send anyone's IP. In that situation, since FTP file transfer connection is not established this will state as an evidence that you are not wanting-initiating that file request (this is the same legal situation as with postal package containing drugs: if you sign for the package it will be strong evidence that you ordered it, otherwise you are free - if you placed order through TOR).

Want it simple? Here it comes

After you have read all above technicalities there is one simple and safe method for FTPing through TOR without all the hassle with ftp methods, ports, mapping etc....... Simply, use web based FTP clients like:

https://www.ftplive.com/ftp.html (no scripting required)

https://www.net2ftp.com/index.php (javascript required)

https://webftp.dreamhost.com (javascript required)

Just be careful as usually on TOR because some of them could require javascript or java (although javascript without plugins and activex is not dangerous, wrong! JavaScript can be used in various ways to exploit browser bugs. you are better off disabling it), so use them at your favorite flavor :)