Hi, I'm having some trouble using sftp. I'm using Slackware 9.1 with OpenSSH_3.7.1p2. Whenever I'm connecting from outside of my home network, when I use the ls command, the connection is immediately closed with the message "Read from remote host hostname.domain: connection reset by peer Connection closed". All other commands that I've tried work (including put and get, cd, mkdir, rmdir, pwd, rm). Since this problem only occurs from outside the network, I'm guessing the problem is due to the router (using NAT) that the sftp server is behind. But why with ls? What's different about that command?

Thanks

I didn't realize that sftp required multiple channels like ftp. Is there any way to configure what ports sftp-server opens up when in passive mode, so that I can forward the appropriate ports on my router? The man pages for sftp-server and sftp don't say anything.

Well, maybe I should have just put this in the newbie thread, but no matter how simple this problem may be, I'm at the end of my rope. SFTP doesn't seem to be documented very well. What I've read recently indicates that it emulates FTP through and ssh tunnel, meaning that I shouldn't have to forward any other ports. However, the behavior I'm getting with the ls command is exactly what would happen with passive FTP. But, using netstat, it doesn't seem that any new ports are being opened when I use ls. Can someone at least guide me to some good documentation on sftp?

Thanks in advance.

The plot thickens...

So I used a packet sniffer (Ethereal) to check exactly what's going on in an SFTP connection to the sshd server from outside the home network. Only one host port and one destination port is opened for SFTP communication, so it shouldn't be a NAT problem (I'm already forwarding port 22). But here's where it gets interesting: when I send the ls command from the remote host, packets get through to the server and are acknowledged. At one point though, 3 packets in a row from the server go unacknowledged, and then I get a "destination unreachable" ICMP message from my DSL modem, which is immediately on the other side of the router. So when that message occurs, the remote sftp client has already closed?

Anyway, I'm gonna stick with this one until I figure it out, but I would love to hear anyone's thoughts on the problem.

You could try adding

iptables -A OUTPUT -p ALL -m state --state ESTABLISHED,RELATED -j ACCEPT

or a variation on that using ip's/interfaces

Anything's worth a try.