Re: SFTP Limited Availability

Chris Braster wrote:
> At my location we have two internal networks. I have installed
> OpenSSH  4.4 on a server on one of those networks and the only change
> I made was for it to use port 21 instead of port 22, since port 21
> was available and getting ports opened here is a production in itself.

So there's a firewall between the client and server?

> If I SFTP to that server from a computer on that same network, it works
> fine. If I attempt to SFTP to that server from a computer on the other
> network, I get the following error:  [...]
> Network error: Connection reset by peer

Port 21 is usually used for FTP, which is one of the most 
firewall-unfriedly protocols around.  In order to handle it most 
firewalls need to inspect the content of the control channel (port 21) 
in order to know what other ports a given FTP connection needs.

I suspect that your firewall is inspecting the connection on port 21 and 
waiting for it to behave like an FTP connection (which it won't; from a 
protocol perspective an sftp session will look nothing like an FTP 
connection on the wire) and eventually gives up and kills the 
connection.  It works on the local net because there's no firewall.

I suggest that you bite the bullet and get your firewall changed.

--
Darren Tucker (dtucker at zip.com.au)
GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4  37C9 C982 80C7 8FF4 FA69
    Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.