sftp: bind to an address

[Elif Gius]

Hi,

I know that with ssh/scp you can bind the ssh-daemon to a specific ip address. So only this ip address has to be allowed through the firewall

e.g.:
ssh -b 11.22.33.44 user@host
scp -o BindAddress=11.22.33.44 user@host

How can I do this with sftp?!

[Matti_Kurkela · Accepted solution]

The commands you mentioned bind only the ssh _client_ to the specified address. You need this only if your client host has more than one IP address that is visible to the network (the localhost address, 127.0.0.1, does not count here).

For sftp, you can use the same kind of options as for scp:
sftp -o BindAddress=11.22.33.44 user@host

The ssh-daemon (sshd) should be running on the remote server (i.e. the server you are connecting to). The ssh-daemon on the local host has no role in handling outgoing connections. If you don't want to accept incoming SSH/scp/SFTP connections on a host, you can disable sshd: the outgoing connections will still work.

To bind the sshd to a specific IP address, you use the configuration directive "ListenAddress" in the sshd_config configuration file. This configuration file is located in /opt/ssh/etc/sshd_config, if you are using HP's pre-packaged OpenSSH.

[Elif Gius]

Hi,
I tried this, but I got an error:

$ sftp -o BindAddress=11.22.33.44 user@55.66.77.88
Connecting to 11.22.33.44...
command-line: line 0: Bad configuration option: BindAddress
Couldn't read packet: Bad file number

[Matti_Kurkela]

Which SSH version are you using?

Is it the commercial one from ssh.com, the HP-customized free OpenSSH from software.hp.com or another version from HP-UX Porting Archive?

If your version is very old, you might want to try a newer version. If you are using the ssh.com product, it may have a very different syntax: I don't have a current ssh.com product at hand so I cannot check at the moment.