What does this error mean?
425 Can't open passive connection: Permission denied.

This error indicates that SecureTransport tried to select a passive port, from the range defined in the server's configuration, that is reserved by the operating system. (On Unix and Linux systems, the list of reserved ports is given in the system /etc/services file. On Windows, it's in %windir%\system32\drivers\etc\services, where %windir% is the directory where Windows is installed.)

Out of the box, SecureTransport can use any port in the range 1024-65535 for the passive port. You can select a specific range from the Admin UI, under Setup > FTP Settings, in the FTP Passive Mode section, so make sure that the range you select doesn't contain any of the system reserved ports.