Re: SFTP Limited Availability

The paperwork is in for getting port 22 opened. Hopefully that is the issue. Thanks to everybody that responded.

- Chris

On Nov 6, 2006, at 5:23 PM, Darren Tucker wrote:

Chris Braster wrote:
At my location we have two internal networks. I have installed
OpenSSH 4.4 on a server on one of those networks and the only change
I made was for it to use port 21 instead of port 22, since port 21
was available and getting ports opened here is a production in itself.

So there's a firewall between the client and server?

If I SFTP to that server from a computer on that same network, it works
fine. If I attempt to SFTP to that server from a computer on the other
network, I get the following error: [...]
Network error: Connection reset by peer

Port 21 is usually used for FTP, which is one of the most firewall- unfriedly protocols around. In order to handle it most firewalls need to inspect the content of the control channel (port 21) in order to know what other ports a given FTP connection needs.

I suspect that your firewall is inspecting the connection on port 21 and waiting for it to behave like an FTP connection (which it won't; from a protocol perspective an sftp session will look nothing like an FTP connection on the wire) and eventually gives up and kills the connection. It works on the local net because there's no firewall.

I suggest that you bite the bullet and get your firewall changed.

--
Darren Tucker (dtucker at zip.com.au)
GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4 37C9 C982 80C7 8FF4 FA69
Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.

Relevant Pages

  • Re: Configure ISA to allow ISA Server to make external FTP Connection
    ... > They know IP, protocol, direction and port. ... > allow the FTP connection but only to a particular domain? ... I am trying to configure ISA to allow the ISA Server itself to make ...
    (microsoft.public.isa.configuration)
  • Re: Configure ISA to allow ISA Server to make external FTP Connection
    ... They know IP, protocol, direction and port. ... allow the FTP connection but only to a particular domain? ... the FTP server should be making the data connections to your ISA ...
    (microsoft.public.isa.configuration)
  • ssh.com v3.2.9.1 slow performance with ftp over ssh port forwarding?
    ... i am using a ssh port forwarded tunnel to secure a ftp connection between 2 ... 210KByte/sec over the forwarded ftp connection. ... forwarding that improve performance? ...
    (comp.security.ssh)
  • Re: SFTP Limited Availability
    ... I made was for it to use port 21 instead of port 22, ... Network error: Connection reset by peer ... In order to handle it most firewalls need to inspect the content of the control channel in order to know what other ports a given FTP connection needs. ... I suspect that your firewall is inspecting the connection on port 21 and waiting for it to behave like an FTP connection and eventually gives up and kills the connection. ...
    (SSH)
  • Re: keeping ports open
    ... If a port is open, it means that 1) a software or service is running on your ... and 2) you're not using a firewall or your firewall isn't ... Use firewall software and hardware and antivirus software that is ... Follow the instructions for hardening Windows and IIS at ...
    (microsoft.public.security)