22

I am trying to SFTP with Filezilla but it is not able to connect to the server and I think this is due to my firewall rules?

I can SSH absolutely fine. The port for SSH is 6128. Can anyone tell me what changes I would have to make to allow an FTP connection over SSH given that SSH is already working?

(Here are my IPtables rules)

Chain INPUT (policy ACCEPT)
target     prot opt source               destination
fail2ban-ssh  tcp  --  anywhere             anywhere             multiport dports ssh
ACCEPT     all  --  anywhere             anywhere
REJECT     all  --  anywhere             loopback/8           reject-with icmp-port-unreachable
ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED
ACCEPT     udp  --  anywhere             anywhere             udp dpt:9987
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:10011
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:30033
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:http
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:https
ACCEPT     tcp  --  anywhere             anywhere             state NEW tcp dpt:6128
ACCEPT     icmp --  anywhere             anywhere             icmp echo-request
LOG        all  --  anywhere             anywhere             limit: avg 5/min burst 5 LOG level debug prefix "iptables denied: "
DROP       all  --  anywhere             anywhere

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
DROP       all  --  anywhere             anywhere

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere

Chain fail2ban-ssh (1 references)
target     prot opt source               destination
RETURN     all  --  anywhere             anywhere
4
  • The response from Filezilla is: "Disconnected: No supported authentication methods available (server sent: publickey) " But I am using the same key that works for my SSH console login (PuTTy on windows btw)
    – tentimes
    Jun 15 '15 at 11:35
  • 2
    SFTP is NOT FTP over SSH. You don't have to 'allow FTP' anywhere. The fact that Filezilla says "No supported authentication methods available" indicates it's connected to the server fine, and the problem is nothing to do with your firewall. How did you set up Filezilla to use your public key?
    – Circus Cat
    Jun 15 '15 at 11:41
  • Hi and welcome to Unix & Linux. It gets confusing b/c SFTP shares a component of its name with the protocol FTP but beyond that they have nothing to do with each other. SSH is a single protocol that runs on port 22 and it provides the abilities to securely connect in the form of a interactive shell or to transfer files over the same connection. The SSH server on the remote side needs to allow for SFTP connections, so I'd look into the SSH server's logs for insights as to why it's failing in addition to making sure that Filezilla has an appropriate key to connect to the server securely.
    – slm
    Jun 15 '15 at 12:31
  • I'd also take a look and verifying SFTP is setup properly from the server itself, yes you can use the command line sftp tool on the server to connect, which is helpful in verifying things before bringing Filezilla into the mix. digitalocean.com/community/tutorials/….
    – slm
    Jun 15 '15 at 12:34
17

To access your sftp from other hosts, please make sure following is installed and configured properly.

  • Installed OpenSSH servers
  • Configured sshd_config
    • PubkeyAuthentication yes
    • Subsystem sftp internal-sftp
  • Added your public key to ~/.ssh/authorized_keys

  • Start the ssh server with port 22/TCP open # /etc/init.d/sshd start

  • # iptables -I INPUT -j ACCEPT -p tcp --dport 22

Finally, test $ sftp <login>@<hostname>

5
  • Another good idea is to check for interactive session using [[ $- != i ]] && return.
    – OMG-1
    Sep 11 '15 at 8:41
  • 4
    Subsystem sftp internal-sftp did it for me. It was set to /usr/libexec/openssh/sftp-server by default, which didn't even exist Aug 12 '17 at 22:52
  • 1
    Adding Subsystem sftp internal-sftp to sshd_config also worked for me with no other changes on Centos.
    – Corgalore
    Oct 25 '19 at 2:36
  • For the sake of simplicity: in my case, a digitalocean droplet with password login, I only needed to enable OpenSSH: "sudo ufw allow OpenSSH" and then "sudo ufw enable", but I suppose that the second shell-command is redundant. By doing so connecting via sftp with FileZille succeeded. In details this is explained here: digitalocean.com/community/tutorials/…
    – Will
    May 1 '20 at 12:08
  • "Configured sshd_config" ; you are referring to the file /etc/ssh/sshd_config? Apr 2 at 14:39
3

In my case, the user had zsh at the top of his .bashrc file, so that he could drop into zsh shell instead of bash.

bash was his default shell. Removing this solved the issue. I then chsh user -s /bin/zsh for the user to retain zsh as his default shell.

1
  • Same problem with other shells (such as fish).
    – Paul
    Nov 25 '17 at 17:45
2

Do you have any text going to the console (e.g. echo statements) in any of your .profile files such as .bashrc? This can mess with sftp connectivity. See my answer to a similar question on serverfault

2
  • Be careful with this indeed. If you auto launch other console such as fish this will result in similar issues.
    – Paul
    Nov 25 '17 at 17:46
  • does this include the standard linux ssh "splash screen" text when you log in? $ ssh user@server.local ; Welcome to Ubuntu 20.04.2 LTS (GNU/Linux 5.8.0-48-generic x86_64) Apr 2 at 14:51
1

Your anti-virus software can also cause this. We faced it recently. ssh via PuTTY was working fine, but WinSCP was not able to connect. Started working once an exception was configured in the Anti-Virus.

0

If you're using filezilla, the following answer helped me:

https://www.digitalocean.com/community/questions/able-to-access-via-ssh-but-not-filezilla

In Filezilla, choose on the menu Edit->Settings, On the left panel expand to Connection->SFTP. On the right side make sure you have the correct private key file, or add if missing the correct entry.

Using the DO web console, login as root and do 'tail -f /var/log/auth.log'. Then try to login with Filezilla and note any messages.

0

My answer to a similar question on serverfault:

I just ran into this problem (specifically for sftp but not ssh, where I could connect without issue) and none of the solutions here worked for me. In my case it was due to having too many ssh keys (IdentityFile's) in ~/.ssh/. It seems that when you don't have a host entry in ~/.ssh/config for the host you are trying to connect to with the right key, it just sends all your keys one by one. I had more than 6 keys, and sure enough, the default MaxAuthTries is 6 (at least in Ubuntu).

The solution was to edit the server's /etc/ssh/sshd_config and increase MaxAuthTries. I set mine to 10.

#MaxAuthTries 6
MaxAuthTries 10

(Or of course, just add a host entry with the right key -- in this particular case I'm trying to log in without the use of a key).

0

In my case, I tried all of the steps described in @OMG-1's answer, and I was able to access the local server from the command line both via ssh and sftp, however CyberDuck was not able to access it via SFTP.

It turns out that I had my company VPN service running, and once I turned that off, I was able to access my local servers again without issue via SFTP in CyberDuck.

0

I solved this with opening the port 22, which has got messed up when I installed NGINX.

Run

sudo ufw status

to see all firewall rules.

If 22 is not listed or allowed, run

sudo ufw allow 22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.