FTP as Tor hidden service.

[Fekete]

I am wondering how to get FTP working as a Tor hidden server. I thought I could use it with just one port by forwarding 21 and disabling pasv in vsftpd.conf with pasv_enable=NO but this doesn't work.

I want users to connect to it with socat over Tor, so a typical session is like this.

$ socat TCP4-LISTEN:2021,fork SOCKS4A:localhost:obfuscated.onion:21,socksport=9050 &
$ ftp localhost 2021
ftp: connect to address ::1: Connection refused
Trying 127.0.0.1...
Connected to localhost.
220 Welcome to OBFUSCATED FTP
Name (localhost:obfuse): 
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.

It doesn't work though...
ftp> dir
500 Illegal PORT command.
ftp: bind: Address already in use

So I'm wondering what I can do to get FTP running, or whether I just have to ditch FTP.

[J65nko]

ftp uses two channels a command channel and a data channel. Each channel uses separate ports
The command channel uses port 21 as destination port. The data channel, uses a destination port >1023. For each data transfer, for example an ftp 'ls', 'get' or 'put' a new data channel is created.

The difference in active and passive ftp is is the data channel. For active ftp the server initiates a connection to the ftp client using source port 20. Because most firewalls don't allow external parties to initiate connections to the clients behind that firewall. passive ftp has been invented.
In passive ftp, the client connects to the server with a port >1023.

I don't know if you could use a proxy to get ftp working with socat and Tor.
Nowadays most ftp servers also provide httpd access so maybe that could be alternative.