28

I am trying to SFTP with Filezilla but it is not able to connect to the server and I think this is due to my firewall rules?

I can SSH absolutely fine. The port for SSH is 6128. Can anyone tell me what changes I would have to make to allow an FTP connection over SSH given that SSH is already working?

(Here are my IPtables rules)

Chain INPUT (policy ACCEPT)
target     prot opt source               destination
fail2ban-ssh  tcp  --  anywhere             anywhere             multiport dports ssh
ACCEPT     all  --  anywhere             anywhere
REJECT     all  --  anywhere             loopback/8           reject-with icmp-port-unreachable
ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED
ACCEPT     udp  --  anywhere             anywhere             udp dpt:9987
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:10011
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:30033
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:http
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:https
ACCEPT     tcp  --  anywhere             anywhere             state NEW tcp dpt:6128
ACCEPT     icmp --  anywhere             anywhere             icmp echo-request
LOG        all  --  anywhere             anywhere             limit: avg 5/min burst 5 LOG level debug prefix "iptables denied: "
DROP       all  --  anywhere             anywhere

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
DROP       all  --  anywhere             anywhere

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere

Chain fail2ban-ssh (1 references)
target     prot opt source               destination
RETURN     all  --  anywhere             anywhere
Improve this question
5
  • The response from Filezilla is: "Disconnected: No supported authentication methods available (server sent: publickey) " But I am using the same key that works for my SSH console login (PuTTy on windows btw)
    – tentimes
    Jun 15, 2015 at 11:35
  • 2
    SFTP is NOT FTP over SSH. You don't have to 'allow FTP' anywhere. The fact that Filezilla says "No supported authentication methods available" indicates it's connected to the server fine, and the problem is nothing to do with your firewall. How did you set up Filezilla to use your public key?
    – Circus Cat
    Jun 15, 2015 at 11:41
  • 1
    Hi and welcome to Unix & Linux. It gets confusing b/c SFTP shares a component of its name with the protocol FTP but beyond that they have nothing to do with each other. SSH is a single protocol that runs on port 22 and it provides the abilities to securely connect in the form of a interactive shell or to transfer files over the same connection. The SSH server on the remote side needs to allow for SFTP connections, so I'd look into the SSH server's logs for insights as to why it's failing in addition to making sure that Filezilla has an appropriate key to connect to the server securely.
    – slm ♦
    Jun 15, 2015 at 12:31
  • I'd also take a look and verifying SFTP is setup properly from the server itself, yes you can use the command line sftp tool on the server to connect, which is helpful in verifying things before bringing Filezilla into the mix. digitalocean.com/community/tutorials/….
    – slm ♦
    Jun 15, 2015 at 12:34
  • May help others: I had an issue where I could ssh to my cVPS but sftp suddenly stopped working. I had made changes to my ~/.bashrc that may have precipitated this: commenting out export TERM=xterm-256color and adding export TERM=rxvt-256color. [I did this as 1. resizing splits in Vim was erasing lines, not resizing; 2, better color palette selection in ~/.vimrc] When I tried to connect to my cVPS on the command line, I got the error described here (the accepted answer was the solution): stackoverflow.com/questions/8250379/…
    – Victoria Stuart
    Jul 21, 2022 at 4:54

8 Answers 8

Reset to default
23

To access your sftp from other hosts, please make sure following is installed and configured properly.

  • Installed OpenSSH servers
  • Configured sshd_config
    • PubkeyAuthentication yes
    • Subsystem sftp internal-sftp

  • Added your public key to ~/.ssh/authorized_keys

  • Start the ssh server with port 22/TCP open # /etc/init.d/sshd start

  • # iptables -I INPUT -j ACCEPT -p tcp --dport 22

Finally, test $ sftp <login>@<hostname>

Improve this answer
5
  • Another good idea is to check for interactive session using [[ $- != i ]] && return.
    – OMG-1
    Sep 11, 2015 at 8:41
  • 8
    Subsystem sftp internal-sftp did it for me. It was set to /usr/libexec/openssh/sftp-server by default, which didn't even exist
    – crackpotHouseplant
    Aug 12, 2017 at 22:52
  • 2
    Adding Subsystem sftp internal-sftp to sshd_config also worked for me with no other changes on Centos.
    – Corgalore
    Oct 25, 2019 at 2:36
  • For the sake of simplicity: in my case, a digitalocean droplet with password login, I only needed to enable OpenSSH: "sudo ufw allow OpenSSH" and then "sudo ufw enable", but I suppose that the second shell-command is redundant. By doing so connecting via sftp with FileZille succeeded. In details this is explained here: digitalocean.com/community/tutorials/…
    – Will
    May 1, 2020 at 12:08
  • 1
    "Configured sshd_config" ; you are referring to the file /etc/ssh/sshd_config?
    – user5359531
    Apr 2, 2021 at 14:39
6

In my case, the user had zsh at the top of his .bashrc file, so that he could drop into zsh shell instead of bash.

bash was his default shell. Removing this solved the issue. I then chsh user -s /bin/zsh for the user to retain zsh as his default shell.

Improve this answer
1
  • 1
    Same problem with other shells (such as fish).
    – Paul
    Nov 25, 2017 at 17:45
5

Do you have any text going to the console (e.g. echo statements) in any of your .profile files such as .bashrc? This can mess with sftp connectivity. See my answer to a similar question on serverfault

Improve this answer
2
  • 1
    Be careful with this indeed. If you auto launch other console such as fish this will result in similar issues.
    – Paul
    Nov 25, 2017 at 17:46
  • does this include the standard linux ssh "splash screen" text when you log in? $ ssh [email protected] ; Welcome to Ubuntu 20.04.2 LTS (GNU/Linux 5.8.0-48-generic x86_64)
    – user5359531
    Apr 2, 2021 at 14:51
1

Your anti-virus software can also cause this. We faced it recently. ssh via PuTTY was working fine, but WinSCP was not able to connect. Started working once an exception was configured in the Anti-Virus.

Improve this answer
0

If you're using filezilla, the following answer helped me:

https://www.digitalocean.com/community/questions/able-to-access-via-ssh-but-not-filezilla

In Filezilla, choose on the menu Edit->Settings, On the left panel expand to Connection->SFTP. On the right side make sure you have the correct private key file, or add if missing the correct entry.

Using the DO web console, login as root and do 'tail -f /var/log/auth.log'. Then try to login with Filezilla and note any messages.

Improve this answer
0

My answer to a similar question on serverfault:

I just ran into this problem (specifically for sftp but not ssh, where I could connect without issue) and none of the solutions here worked for me. In my case it was due to having too many ssh keys (IdentityFile's) in ~/.ssh/. It seems that when you don't have a host entry in ~/.ssh/config for the host you are trying to connect to with the right key, it just sends all your keys one by one. I had more than 6 keys, and sure enough, the default MaxAuthTries is 6 (at least in Ubuntu).

The solution was to edit the server's /etc/ssh/sshd_config and increase MaxAuthTries. I set mine to 10. 

#MaxAuthTries 6
MaxAuthTries 10

(Or of course, just add a host entry with the right key -- in this particular case I'm trying to log in without the use of a key).

Improve this answer
0

In my case, I tried all of the steps described in @OMG-1's answer, and I was able to access the local server from the command line both via ssh and sftp, however CyberDuck was not able to access it via SFTP.

It turns out that I had my company VPN service running, and once I turned that off, I was able to access my local servers again without issue via SFTP in CyberDuck.

Improve this answer
0

I solved this with opening the port 22, which has got messed up when I installed NGINX.

Run

sudo ufw status

to see all firewall rules.

If 22 is not listed or allowed, run

sudo ufw allow 22
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .