SFTP hidden service



=========================  SFTP hidden service  =======================

This guide has been written to help Windows users, but it can also be used with Linux, replacing Putty with OpenSSH and Gpg4Win with GnuPG. FileZilla can be replaced with the sftp command line utility.


- download the required sofware:
--------------------------------
*) Tor Browser Bundle - https://www.torproject.org/download/
*) PuttyGen and Pageant - http://www.chiark.greenend.org.uk/~sgtatham/putty/download.html
*) Filezilla - https://filezilla-project.org/
*) Gpg4Win   - http://www.gpg4win.org/download.html


- create a new SSH key for logging in:
--------------------------------------
*) puttygen - Generate a new SSH-2 RSA 4906 bits key.
*) puttygen - Save public key to a file named "reg-username.txt", where 'username' is your chosen username. The username may contain only lowercase letters a-z, numbers 0-9 and a dot ".".
*) puttygen - Enter your chosen passphrase and Save private key.


- client setup and registration:
--------------------------------
*) tor - install the Tor Browser Bundle and run Start Tor Browser.exe
*) filezilla - in Edit-Settings-Generic proxy set Type: SOCKS5, Host: 127.0.0.1, Port: 9150
*) filezilla - log in to the hidden service using Protocol: SFTP, Logon Type: Normal, User: sftp.anon, Password: anon
*) filezilla - upload your personalized reg-username.txt to the remote directory called "registration"
*) filezilla - disconnect


- create a new GPG key for signing and encrypting your messages:
----------------------------------------------------------------
*) gpg4win - run GPA.exe, choose Keys-New Key - Algorithm: RSA, Key size: 4096 (or 3072), Name: sftp.username (use your chosen username), Email: [email protected], Expires: no
*) gpg4win - choose a passphrase for the key and let the program create it
*) gpg4win - select the key and Export it to a file named "gpg-username.txt"


- set up the key agent, test your new account and upload your GPG key:
----------------------------------------------------------------------
*) wait until your account is activated (this is done manually and may take a day or two)
*) pageant - start Pageant and use Add Key to add your Private SSH Key created using PuttyGen (enter the passphrase of the key)
*) filezilla - use the same general settings as before, but set User to sftp.username (where username is your chosen username), Logon Type: Interactive
*) filezilla - upload your gpg-username.txt to the remote directory called "gpg"
*) disconnect


- learn how to use the mailbox:
-------------------------------
*) a private message is a normal text file generated by GPG in "armor" (ASCII) mode, containing a text message (.txt) or another type of file (eg. an image or an archive containing a folder) in an encapsulated form (.asc)
*) deliver this file to some other user's mailbox by uploading it to a "mailbox/username/" directory
*) private messages must be signed and encrypted using GPG as anyone can upload or download them


- learn how to use the forums:
------------------------------
*) a forum post is a normal text file generated by GPG in "armor" (ASCII) mode, containing a text message (.txt) or another type of file (eg. an image or an archive containing a folder) in an encapsulated form (.asc)
*) publish the file in a forum by uploading it to a "forum/forum_title" directory
*) forum posts must be signed using GPG
*) forum posts shouldn't be encrypted, unless you are posting to a private forum and share the private key created for this purpose with the other posters
*) only the administrator can create new forums - you can request it by sending him a private message - (the username of the administrator is in the About.txt file)