Using SFTP port 22 on both server and client

Question

A customer asked me to setup a secure FTP server (SFTP using openSSH or FreeSSHd).

This new server will pass through a firewall configured to only allow port 22.

It may sound strange, but for security reasons, they prefer not to open other ports on the firewall.

They are asking if the server can use port 22 for the server itself but also for the client.

The server is running Windows Server 2008 64 (with freeSSH/OpenSSH)

The client is running Windows XP (with putty/winscp)

Can I use port 22 instead of the big port pool it usually uses? (for both the connection and data transfer)

If not, how can I configure the SFTP server to use a different port?

Is there a specific command to set it up or a manual for freeSSH/openSSH?

Can different operating systems also create other issues I might face later?

Solution 1

Put simply, this cannot be done without significant effort.

• Windows requires at least 250 ports in the ephemeral port range. To include 22 in the range, you'd probably include the listening ports for important system services (if Windows allowed the range to start below 1024 which is doubtful)

• Windows does not appear to support changing the outgoing port with NAT.

• To my knowledge, no SSH implementation on Windows allows explicitly setting the client port.

Your options are:

• Introduce a device in front of the server to manipulate the traffic.

• Build your own heavily patched SSH client application.

• Convince your client that their requirements are ludicrous.

Solution 2

The client is apparently operating under the assumption that SFTP is like regular FTP in that it has separate control and data connections. For SFTP this is not the case, only port 22 is needed on the SFTP server and everything gets multiplexed on that one port.

SFTP and FTP are similar only with regard to their use-case. Networking wise, they are completely different designs.

However, I must point out that there is FTPS too, which is more like regular FTP, but with encryption bolted on.

The clients requirement for port 22 on both ends likely comes from the whole active/passive operation from FTP, which is not relevant to SFTP

Solution 3

Imo, this whole is some kind of a misunderstanding. So I'm reluctant to even answer this. But OK.

In general, you do not specify a source port of a TCP/IP application. The source port is in 99.9% cases assigned automatically by the local operating system.

Also, the source port is in many cases the only unique piece of information about the TCP/IP connection. So it cannot be fixed. Otherwise you would not be able to open multiple connections from the local machine to the server.

Even, if you were able to fix the local port (and I'm not aware of any SSH/SFTP client that allows that), you cannot configure this on the server side. The server has no control over the local port used by a client.

While there can be workarounds or alternative ways, I cannot give you any, as you didn't explain us why you actually want to do this.

I can carry on like this for hours, but it's imo pointless, as I do not think, that I actually understand you, or that you or your client understand, what you/they want.