1

I have an odd situation.

From Computer A with PSFTP.EXE (putty sftp client) I can connect to a remote sftp server and use dir and chdir to browse around. If I try to get or put files I get a permission error.

From Computer B with PSFTP.EXE (same version) I can connect to the SAME server with the SAME credentials and use dir, chdir to browse around and also get/put work.

The only difference is that Computer A is behind a firewall that blocks outgoing traffic. The firewall admin opened port 22 for me. Previous to that I could not even connect.

I am confused because obviously data is flowing in both directions (directory listings return data). And I know that I am connecting to the same server (files put by computer B show up in directory listings from Computer A)

Is there anything I can have the firewall admin look at that would allow such behavior?
i.e. connections are allowed, dir&chdir are allowed but file transmissions get/put are denied? in fact all file changes are denied (mv, ren, rm, etc)

I know it sounds like a permissions issue on the server but if that were the case I would expect Computer B to have the same trouble and it has absolutely no problems.

Edit #1

Here is Computer A's session details: (slightly changed to protect sensitive data)

psftp> open servername.com
Looking up host "servername.com"
Connecting to x.x.x.x port 22
**Server version: SSH-2.0-OpenSSH_4.6**
Using SSH protocol version 2
We claim version: SSH-2.0-PuTTY_Release_0.62
Doing Diffie-Hellman group exchange
Doing Diffie-Hellman key exchange with hash SHA-256
Host key fingerprint is:
ssh-rsa 1024 
Initialised AES-256 SDCTR client->server encryption
Initialised HMAC-SHA1 client->server MAC algorithm
Initialised AES-256 SDCTR server->client encryption
Initialised HMAC-SHA1 server->client MAC algorithm
login as: username
password:
Sent password
Access granted
Opened channel for session
Started a shell/command
Connected to servername.com
Remote working directory is /


Here is Computer B's session details: (slightly changed to protect sensitive data)

psftp> open servername.com
Looking up host "servername.com"
Connecting to x.x.x.x port 22
**Server version: SSH-2.0-0.0**
Using SSH protocol version 2
We claim version: SSH-2.0-PuTTY_Release_0.62
Doing Diffie-Hellman group exchange
Doing Diffie-Hellman key exchange with hash SHA-1
Host key fingerprint is:
ssh-dss 1024 ...
Initialised AES-256 CBC client->server encryption
Initialised HMAC-SHA1 client->server MAC algorithm
Initialised AES-256 CBC server->client encryption
Initialised HMAC-SHA1 server->client MAC algorithm
Pageant is running. Requesting keys.
Pageant has 0 SSH-2 keys
login as: username
password:
Sent password
Access granted
Opened channel for session
Started a shell/command
Connected to servername.com
Remote working directory is /
5
  • What SFTP server are you using? Can you include its log for both scenarios? – Martin Prikryl Feb 26 '15 at 17:40
  • I am not 100% sure. Looks like OpenSSH_4.6. I added some details that I can get from the server with verbose logging. The server version and key fingerprints are different when connecting from Computer A vs Computer B. yet I am 100% sure that I am landing on the same server with both connections. – Rex Bloom Feb 26 '15 at 18:30
  • Also I was mistaken. get works, it is only put that fails. – Rex Bloom Feb 26 '15 at 18:52
  • More details...this is a McAffee firewall and has some sort of SSH proxy. I believe that the firewall is basically managing the ssh session and getting in the way and that is causing the issues at the remote end. – Rex Bloom Feb 26 '15 at 19:21
  • That seems to be the case. See my update to the answer. – Martin Prikryl Feb 27 '15 at 7:00
3

Firewall cannot block individual downloads/uploads with SFTP. The connection is encrypted. The firewall cannot see that's going on between the client and the server, let only intervene anyhow. All the firewall can do is to block whole connection, but not individual operations.

But the SFTP server can block the downloads/uploads based on client IP address. For example ProFTPD/mod_sftp allows that (using Allow directive).


From the logs you have provided, it's obvious that you are connecting to a different server each time. While it may be the same physical server, it's definitely a different SSH server. Even if you are connecting to the same IP address and port, it can be the firewall that routes you to a different port (even a different IP address obviously, but you claim that not to be the case) based on your local IP address.

3
  • Interestingly, ssh allows a way to definively test this latter hypothesis. If from both clients you do an ssh-keyscan on the server and compare the results, you will instantly know if you're actually connecting to different servers. – MadHatter Feb 27 '15 at 7:40
  • @MadHatter OP already commented that The server version and key fingerprints are different when connecting from Computer A vs Computer B. – Martin Prikryl Feb 27 '15 at 7:49
  • Martin: good catch, thank you. You already had my +1, but I'd add another, if I could. – MadHatter Feb 27 '15 at 8:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.