2

A customer asked me to setup a secure FTP server (SFTP using openSSH or FreeSSHd).

This new server will pass through a firewall configured to only allow port 22.

It may sound strange, but for security reasons, they prefer not to open other ports on the firewall.

They are asking if the server can use port 22 for the server itself but also for the client.

The server is running Windows Server 2008 64 (with freeSSH/OpenSSH)

The client is running Windows XP (with putty/winscp)

Can I use port 22 instead of the big port pool it usually uses? (for both the connection and data transfer)

If not, how can I configure the SFTP server to use a different port?

Is there a specific command to set it up or a manual for freeSSH/openSSH?

Can different operating systems also create other issues I might face later?

6
  • Do you/they mean a local ephemeral port of outgoing TCP connection? – Martin Prikryl Nov 2 '17 at 13:55
  • Can you give network details on how does the client connects to the server, not just their OS? Of course, only if you're really sure that they need the outgoing connection to use port 22 as SOURCE, that is just too weird to be asked without a very good justification... – Zip Nov 2 '17 at 18:06
  • hey Martin, they mean that they need the port 22 allocated in both direction! (server and client) – butterfly77 Nov 3 '17 at 7:09
  • At the moment they didn't gave me other information other than theese, I know it's weird I said it also! But they say they need this for ehnanced security (??) . We are talking about FTP over SSH and I'm wondering if the port number allocated for the client may be encrypted as well so that only client sees the port and not the firewall if so there is no problem at all! Do you think if that can be possible with ssh? Today I will make some test. – butterfly77 Nov 3 '17 at 7:15
  • "port 22 allocated in both direction" is vague. If you want to ask a question here you need a way better information. + SFTP and "FTP over SSH" are two completely different things. Again, you need a way better information, before asking here. + Regarding port encryption: The first network component after the client (what is probably the firewall) needs to know the port number. There's no way around that. That's how IP protocol works. + If you want to reply someone here, you need to use @username syntax. Otherwise the message does not get to the recipient. – Martin Prikryl Nov 3 '17 at 20:21
2

Put simply, this cannot be done without significant effort.

  • Windows requires at least 250 ports in the ephemeral port range. To include 22 in the range, you'd probably include the listening ports for important system services (if Windows allowed the range to start below 1024 which is doubtful)

  • Windows does not appear to support changing the outgoing port with NAT.

  • To my knowledge, no SSH implementation on Windows allows explicitly setting the client port.

Your options are:

  • Introduce a device in front of the server to manipulate the traffic.

  • Build your own heavily patched SSH client application.

  • Convince your client that their requirements are ludicrous.

1

The client is apparently operating under the assumption that SFTP is like regular FTP in that it has separate control and data connections. For SFTP this is not the case, only port 22 is needed on the SFTP server and everything gets multiplexed on that one port.

SFTP and FTP are similar only with regard to their use-case. Networking wise, they are completely different designs.

However, I must point out that there is FTPS too, which is more like regular FTP, but with encryption bolted on.

The clients requirement for port 22 on both ends likely comes from the whole active/passive operation from FTP, which is not relevant to SFTP

1

Imo, this whole is some kind of a misunderstanding. So I'm reluctant to even answer this. But OK.

In general, you do not specify a source port of a TCP/IP application. The source port is in 99.9% cases assigned automatically by the local operating system.

Also, the source port is in many cases the only unique piece of information about the TCP/IP connection. So it cannot be fixed. Otherwise you would not be able to open multiple connections from the local machine to the server.

Even, if you were able to fix the local port (and I'm not aware of any SSH/SFTP client that allows that), you cannot configure this on the server side. The server has no control over the local port used by a client.

While there can be workarounds or alternative ways, I cannot give you any, as you didn't explain us why you actually want to do this.

I can carry on like this for hours, but it's imo pointless, as I do not think, that I actually understand you, or that you or your client understand, what you/they want.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.