1

I have an odd situation.

From Computer A with PSFTP.EXE (putty sftp client) I can connect to a remote sftp server and use dir and chdir to browse around. If I try to get or put files I get a permission error.

From Computer B with PSFTP.EXE (same version) I can connect to the SAME server with the SAME credentials and use dir, chdir to browse around and also get/put work.

The only difference is that Computer A is behind a firewall that blocks outgoing traffic. The firewall admin opened port 22 for me. Previous to that I could not even connect.

I am confused because obviously data is flowing in both directions (directory listings return data). And I know that I am connecting to the same server (files put by computer B show up in directory listings from Computer A)

Is there anything I can have the firewall admin look at that would allow such behavior?
i.e. connections are allowed, dir&chdir are allowed but file transmissions get/put are denied? in fact all file changes are denied (mv, ren, rm, etc)

I know it sounds like a permissions issue on the server but if that were the case I would expect Computer B to have the same trouble and it has absolutely no problems.

Edit #1

Here is Computer A's session details: (slightly changed to protect sensitive data)

psftp> open servername.com
Looking up host "servername.com"
Connecting to x.x.x.x port 22
**Server version: SSH-2.0-OpenSSH_4.6**
Using SSH protocol version 2
We claim version: SSH-2.0-PuTTY_Release_0.62
Doing Diffie-Hellman group exchange
Doing Diffie-Hellman key exchange with hash SHA-256
Host key fingerprint is:
ssh-rsa 1024 
Initialised AES-256 SDCTR client->server encryption
Initialised HMAC-SHA1 client->server MAC algorithm
Initialised AES-256 SDCTR server->client encryption
Initialised HMAC-SHA1 server->client MAC algorithm
login as: username
password:
Sent password
Access granted
Opened channel for session
Started a shell/command
Connected to servername.com
Remote working directory is /


Here is Computer B's session details: (slightly changed to protect sensitive data)

psftp> open servername.com
Looking up host "servername.com"
Connecting to x.x.x.x port 22
**Server version: SSH-2.0-0.0**
Using SSH protocol version 2
We claim version: SSH-2.0-PuTTY_Release_0.62
Doing Diffie-Hellman group exchange
Doing Diffie-Hellman key exchange with hash SHA-1
Host key fingerprint is:
ssh-dss 1024 ...
Initialised AES-256 CBC client->server encryption
Initialised HMAC-SHA1 client->server MAC algorithm
Initialised AES-256 CBC server->client encryption
Initialised HMAC-SHA1 server->client MAC algorithm
Pageant is running. Requesting keys.
Pageant has 0 SSH-2 keys
login as: username
password:
Sent password
Access granted
Opened channel for session
Started a shell/command
Connected to servername.com
Remote working directory is /
0

1 Answer 1

3

Firewall cannot block individual downloads/uploads with SFTP. The connection is encrypted. The firewall cannot see that's going on between the client and the server, let alone intervene anyhow. All the firewall can do is to block whole connection, but not individual operations.

But the SFTP server can block the downloads/uploads based on client IP address. For example ProFTPD mod_sftp allows that (using Allow directive).


From the logs you have provided, it's obvious that you are connecting to a different server each time. While it may be the same physical server, it's definitely a different SSH server. Even if you are connecting to the same IP address and port, it can be the firewall that routes you to a different port (even a different IP address obviously, but you claim that not to be the case) based on your local IP address.

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .