Linux – SFTP is working but SSH failed why

authenticationlinuxsftpssh

I have SFTP client library[3rd party] which Fails to connect to the sftp server [use password authentication].

From 3rd party log file I can see that SSH/SFTP authentication is successs but ssh channel open is failed hence sftp connect is failing….

3rd party library first creates ssh tunnel and then cretaes a channel and then open a sftp-subsystem

I can see that ssh tunnel is create successfuly , but channel open is
failed [server send the channel open failure msg], this may be becuase the user doesn't have ssh access to that server . But I am not sure

I can do manual sftp using command but SSH failed.
sftp syeds@10.18.20.13 works
ssh syeds@10.18.20.13 Fails

OS: Linux

But why manuly sftp command working fine ?

Best Answer

You seem to be having two different problems:

impossibility to login to shell (shell access can be disabled on the server) and
impossibility for the library to open SFTP connection.

In the latter case you need to contact library vendor for assistance - there can be different reasons for the problem.

One thing you can do yourself is check that SFTP subsystem is really configured on the server. If SFTP server is not specified in config, some applications manage to open command channel and try to guess SFTP server location and run it via command channel. Libraries usually don't do this.

Related Solutions

Ssh – How to disable sftp subsystem for a specific user or group

If you are using the SFTP SubSystem where it spawns a separate process, you could create a sftp group and only allow execution of the sftp-server binary for that group. It will not be possible to do this with the newer internalized sftp daemon, which is specified with internal-sftp.

If they have shell access, they will still be able to scp. Do you have a particular goal in mind?

Edit

If you want to restrict your user to only executing or utilizing a specific program, I would probably recommend a shell wrapper instead. command= might work but it seems more likely to be fallible. I would do more testing to be sure.

A shell wrapper, such as scponly, will only allow the end-user to scp. I have modified the source of scponly before to only allow CVS execution, for example. This can also be done with a shell script but it is easier to make mistakes if you do not fully understand the scope of what you are trying to do.

SSH X11 not working

The reason ssh X forwarding wasn't working was because I have a /etc/ssh/sshrc config file.

The end of the sshd(8) man page states:

If ~/.ssh/rc exists, runs it; else if /etc/ssh/sshrc exists, runs it; otherwise runs xauth

So I add the following commands to /etc/ssh/sshrc (also from the sshd man page) on the server side:

if read proto cookie && [ -n "$DISPLAY" ]; then
        if [ `echo $DISPLAY | cut -c1-10` = 'localhost:' ]; then
                # X11UseLocalhost=yes
                echo add unix:`echo $DISPLAY |
                    cut -c11-` $proto $cookie
        else
                # X11UseLocalhost=no
                echo add $DISPLAY $proto $cookie
        fi | xauth -q -
fi

And it works!

Best Answer

Related Solutions

Ssh – How to disable sftp subsystem for a specific user or group

SSH X11 not working

Related Topic