0

I'm trying to create a SFTP connection to a remote CentOS v6.8 webserver. When i connect through SFTP from my office network i can connect without any problems but when i try it from a different location(e.g. my phone or the client's PC/network) SFTP doesn't work. FTP connection with the same account can be established.

Things i've tried so far: I checked the Iptables. They didn't have any configuration but i added a few lines according to some of the tutorials i've followed in creating a sftp user & connection. tutorial iptables:

Chain INPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:ssh
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:ssh state NEW !recent: CHECK seconds: 60 hit_count: 4 name: ssh side: source
           tcp  --  anywhere             anywhere            tcp dpt:ssh state NEW recent: SET name: ssh side: source

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

In the whitelist/blacklists i can't find anything that blocks or allow IP adresses. The hosting company doesn't help since it's an unmanaged server and we would prefer to solve it without them charging us for it.

Is there anywhere i can check or edit to solve this issue?

Note: Im a Backend Developer, My server/Linux knowledge is limited & i have SSH root access

[EDIT 1] running tcpdump 'tcp[13] & 2 != 0'

This is a succesful connection:

11:39:12.005721 IP static.kpn.net.51636 > WCMZ005.local.ssh: Flags [S], seq 2112850653, win 65535, options [mss 1380,nop,wscale 7,nop,nop,sackOK], length 0
11:39:12.005764 IP WCMZ005.local.ssh > static.kpn.net.51636: Flags [S.], seq 3218812204, ack 2112850654, win 14600, options [mss 1460,nop,nop,sackOK,nop,wscale 7], length 0

This is a connection from my phone. After a while my phone gives a timeout error

11:37:28.890146 IP 183.214.141.102.11306 > 172.16.3.85.ssh: Flags [S], seq 2750343693, win 14600, options [mss 1380,sackOK,TS val 690507696 ecr 0,nop,wscale 7], length 0
11:37:28.890190 IP 172.16.3.85.ssh > 183.214.141.102.11306: Flags [S.], seq 381070382, ack 2750343694, win 14480, options [mss 1460,sackOK,TS val 955131997 ecr 690507696,nop,wscale 7], length 0
11:37:33.818772 IP scanner2.labs.rapid7.com.https > 172.16.3.212.https: Flags [S], seq 2904545780, win 65535, length 0
11:37:43.506259 IP 216.243.31.2.41000 > 172.16.3.71.http: Flags [S], seq 1532676084, win 65535, length 0
11:37:53.275212 IP 183.214.141.102.sec-pc2fax-srv > 172.16.3.85.ssh: Flags [S], seq 579659209, win 14600, options [mss 1380,sackOK,TS val 690532061 ecr 0,nop,wscale 7], length 0
11:37:53.275254 IP 172.16.3.85.ssh > 183.214.141.102.sec-pc2fax-srv: Flags [S.], seq 83614273, ack 579659210, win 14480, options [mss 1460,sackOK,TS val 955156383 ecr 690532061,nop,wscale 7], length 0
11:38:14.619947 IP 183.214.141.102.63060 > 172.16.3.85.ssh: Flags [S], seq 2648927808, win 14600, options [mss 1380,sackOK,TS val 690553404 ecr 0,nop,wscale 7], length 0
11:38:14.619988 IP 172.16.3.85.ssh > 183.214.141.102.63060: Flags [S.], seq 4153938295, ack 2648927809, win 14480, options [mss 1460,sackOK,TS val 955177727 ecr 690553404,nop,wscale 7], length 0
0

The iptables rules you have posted don't include any DROP or REJECT. Even the default policy for INPUT chain is ACCEPT. This means that your server is accepting all types of traffic.

Since you can connect from at least one location, this means that the service is running correctly and the server is accessible. You need to check in the locations why can't access the requested service.

My advice is to run tcpdump on your server when trying to connect. If you did not see any TCP SYN packet coming, the IP or port may be blocked somewhere on the path to the server.

  • Quick question, is it normal that tcpdump shows like a 100 lines every second, constantly? Makes it a challenge to see anything – Taacoo Mar 16 '17 at 9:19
  • Edited with the result of a tcpdump – Taacoo Mar 16 '17 at 9:36
0

You said :

i can connect without any problems but when i try it from a different location(e.g. my phone or the client) SFTP doesn't work. FTP connection with the same account can be established.

Maybe, your FTP traffic is NATted and not your SFTP traffic ? Can you verify on your router if the ports of your server are correctly natted to outside ?

Can you join logs of the fail of the SFTP connction ?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.