Windows Server 2016 SFTP连接报错Got eof from child process求解决

背景信息 #

• 服务器运行OpenSSH for Windows 8.9
• PuTTY可正常通过用户名密码建立SSH会话，执行cd、dir等目录操作
• 因安全策略禁用TLS1.x，无法使用“explicit FTP Over TLS”
• 日志中IP已脱敏为xxx.xxx.xxx.xxx

FileZilla调试日志 #

Status: Disconnected from server
Trace:  CControlSocket::DoClose(66)
Trace:  CControlSocket::ResetOperation(66)
Trace:  CFileZillaEnginePrivate::ResetOperation(66)
Trace:  CControlSocket::DoClose(66)
Trace:  CControlSocket::ResetOperation(66)
Trace:  CFileZillaEnginePrivate::ResetOperation(66)
Trace:  CControlSocket::DoClose(66)
Trace:  CControlSocket::ResetOperation(66)
Trace:  CFileZillaEnginePrivate::ResetOperation(66)
Trace:  CFileZillaEnginePrivate::ResetOperation(0)
Trace:  CControlSocket::SendNextCommand()
Trace:  CSftpConnectOpData::Send() in state 0
Status: Connecting to xxx.xxx.xxx.xxx...
Trace:  Going to execute C:\Program Files\FileZilla FTP Client\fzsftp.exe
Response:   fzSftp started, protocol_version=11
Trace:  CSftpConnectOpData::ParseResponse() in state 0
Trace:  CControlSocket::SendNextCommand()
Trace:  CSftpConnectOpData::Send() in state 3
Command:    open "myusername@xxx.xxx.xxx.xxx" 22
Trace:  Looking up host "xxx.xxx.xxx.xxx" for SSH connection
Trace:  Connecting to xxx.xxx.xxx.xxx port 22
Trace:  We claim version: SSH-2.0-FileZilla_3.60.2
Trace:  Connected to xxx.xxx.xxx.xxx
Trace:  Remote version: SSH-2.0-OpenSSH_for_Windows_8.9
Trace:  Using SSH protocol version 2
Trace:  Doing ECDH key exchange with curve Curve25519 and hash SHA-256 (SHA-NI accelerated)
Trace:  Server also has ecdsa-sha2-nistp256/rsa-sha2-512/rsa-sha2-256 host keys, but we don't know any of them
Trace:  Host key fingerprint is:
Trace:  ssh-ed25519 255 SHA256:+N7KuNqe4nd0Qq6EvuEDFsWX+EeLIkDN0SebsjsPITQ
Trace:  Initialised AES-256 GCM outbound encryption
Trace:  Initialised AES256 GCM outbound MAC algorithm (in ETM mode) (required by cipher)
Trace:  Initialised AES-256 GCM inbound encryption
Trace:  Initialised AES256 GCM inbound MAC algorithm (in ETM mode) (required by cipher)
Status: Using username "myusername". 
Trace:  Attempting keyboard-interactive authentication
Trace:  Server refused keyboard-interactive authentication
Command:    Pass: *************
Trace:  Sent password
Trace:  Access granted
Trace:  Opening main session channel
Trace:  Opened main channel
Trace:  Started a shell/command
Status: Connected to xxx.xxx.xxx.xxx
Trace:  Got eof from child process
Trace:  CControlSocket::DoClose(64)
Trace:  CControlSocket::ResetOperation(66)
Trace:  CSftpConnectOpData::Reset(66) in state 3
Error:  Could not connect to server
Trace:  CFileZillaEnginePrivate::ResetOperation(66)
Status: Waiting to retry...
Trace:  CControlSocket::DoClose(66)
Trace:  CControlSocket::ResetOperation(66)
Trace:  CFileZillaEnginePrivate::ResetOperation(66)
Trace:  CControlSocket::DoClose(66)
Trace:  CControlSocket::ResetOperation(66)
Trace:  CFileZillaEnginePrivate::ResetOperation(66)
Trace:  CControlSocket::SendNextCommand()
Trace:  CSftpConnectOpData::Send() in state 0
Status: Connecting to xxx.xxx.xxx.xxx...
Trace:  Going to execute C:\Program Files\FileZilla FTP Client\fzsftp.exe
Response:   fzSftp started, protocol_version=11
Trace:  CSftpConnectOpData::ParseResponse() in state 0
Trace:  CControlSocket::SendNextCommand()
Trace:  CSftpConnectOpData::Send() in state 3
Command:    open "myusername@xxx.xxx.xxx.xxx" 22
Trace:  Looking up host "xxx.xxx.xxx.xxx" for SSH connection
Trace:  Connecting to xxx.xxx.xxx.xxx port 22
Trace:  We claim version: SSH-2.0-FileZilla_3.60.2
Trace:  Connected to xxx.xxx.xxx.xxx
Trace:  Remote version: SSH-2.0-OpenSSH_for_Windows_8.9
Trace:  Using SSH protocol version 2
Trace:  Doing ECDH key exchange with curve Curve25519 and hash SHA-256 (SHA-NI accelerated)
Trace:  Server also has ecdsa-sha2-nistp256/rsa-sha2-512/rsa-sha2-256 host keys, but we don't know any of them
Trace:  Host key fingerprint is:
Trace:  ssh-ed25519 255 SHA256:+N7KuNqe4nd0Qq6EvuEDFsWX+EeLIkDN0SebsjsPITQ
Trace:  Initialised AES-256 GCM outbound encryption
Trace:  Initialised AES256 GCM outbound MAC algorithm (in ETM mode) (required by cipher)
Trace:  Initialised AES-256 GCM inbound encryption
Trace:  Initialised AES256 GCM inbound MAC algorithm (in ETM mode) (required by cipher)
Status: Using username "myusername". 
Trace:  Attempting keyboard-interactive authentication
Trace:  Server refused keyboard-interactive authentication
Command:    Pass: *************
Trace:  Sent password
Trace:  Access granted
Trace:  Opening main session channel
Trace:  Opened main channel
Trace:  Started a shell/command
Status: Connected to xxx.xxx.xxx.xxx
Trace:  Got eof from child process
Trace:  CControlSocket::DoClose(64)
Trace:  CControlSocket::ResetOperation(66)
Trace:  CSftpConnectOpData::Reset(66) in state 3
Error:  Could not connect to server
Trace:  CFileZillaEnginePrivate::ResetOperation(66)

原因分析 #

从日志流程看，SSH握手、身份验证均成功完成，但在启动SFTP子会话时触发EOF错误，核心原因集中在以下几点：

1. SFTP子系统配置异常：OpenSSH服务器的sshd_config中SFTP子系统路径配置错误，或sftp-server.exe文件损坏、缺失
2. 用户SFTP权限受限：服务器未给该用户启用SFTP访问权限，或用户默认shell配置导致无法启动SFTP子进程
3. 客户端与服务器版本兼容性问题：FileZilla自带的fzsftp.exe与OpenSSH for Windows 8.9存在特定版本兼容性bug

解决办法 #

1. 检查并修复OpenSSH服务器SFTP配置 #

• 打开服务器上的C:\ProgramData\ssh\sshd_config文件（若不存在则检查OpenSSH安装目录下的配置文件）
• 确认存在Subsystem sftp sftp-server.exe配置项，若使用绝对路径需确保指向正确位置（通常为C:\Windows\System32\OpenSSH\sftp-server.exe）
• 修改配置后，重启OpenSSH SSH Server服务（通过Windows服务管理器操作）

2. 验证用户SFTP访问权限 #

• 检查sshd_config中是否存在Match规则限制该用户的SFTP访问，若有则调整规则
• 在服务器本地执行sftp-server.exe，确认文件可正常运行（无报错提示）
• 确保用户账户未被设置为仅允许SSH shell访问而禁止SFTP

3. 调整FileZilla客户端设置 #

• 打开FileZilla站点管理器，进入目标站点的SFTP设置页
• 启用“使用SFTP协议的替代命令”，填写系统自带的SFTP客户端路径：C:\Windows\System32\OpenSSH\sftp.exe，替代FileZilla的fzsftp.exe
• 更新FileZilla到最新稳定版本，排除版本兼容性问题

4. 排查服务器安全策略干扰 #

• 确认服务器防火墙未拦截22端口的SFTP会话数据
• 检查Windows Defender或第三方杀毒软件，确认未误杀sftp-server.exe或fzsftp.exe进程

内容的提问来源于stack exchange，提问作者Ray White