Download
We're evolving to serve you better! This current forum has transitioned to read-only mode. For new discussions, support, and engagement, we've moved to GitHub Discussions.

SFTP failing – due to using an outdated authentication algorithm or protocol?

  • #7003
    Avatar photo[anonymous]

    I’m trying to upload my site to my server using SFTP, but “An error occurred during connection to the server …”.

    I am using key authentication. Looking at Publii logs, I can see authentication failing:

    [Wed, 02 Mar 2022 18:07:23 GMT] ERR (1): Error: sftpConnect: All configured authentication methods failed

    The server is running OpenBSD 7.0 and when Publii fails to synchronize, I can see the authlog as follows:

    Mar 2 19:59:46 server sshd[45539]: userauth_pubkey: key type ssh-rsa not in PubkeyAcceptedAlgorithms [preauth]

    Mar 2 19:59:46 server sshd[45539]: Received disconnect from x.x.x.x port 40580:11:[preauth]

    I have double checked the settings and everything should be good.

    When connecting from MacOS shell using sftp using the very same key, everything works as expected. In the server log I can see this instead:

    Mar 2 20:00:54 server sshd[98980]: Accepted publickey for kb from x.x.x.x port 55401 ssh2: RSA SHA256:ZZ…

    Is there any workaround or simple fix on the Publii client side for this?

    Unfortunately changing the server configuration to allow old authentication mechanisms is not an option here.

    #7027
    Avatar photo[anonymous]

    Hi,

    Nearest release – v.0.39 which is planned for the next week will contain bigger update of the SFTP dependency – I suppose that it can solve your issue. Temporary you can use manual deployment method: https://getpublii.com/docs/server-configuration.html#manual which is always a fallback for all issues with sync methods.

    #7035
    Avatar photo[anonymous]

    Thanks, looking forward to try it out. I found the tar archive output being pretty good workaround as well.

    #7164
    Avatar photo[anonymous]

    Unfortunately with Version: 0.39.1 (build 15483) the problem still persists.

    Logs on the OpenBSD server still look the same when I press the  “Test connection” -button on the server type configuration page.

    Publii claims that “Application was able to connect with your server but was unable to store files…”, but based on the server log that is not true.

    Using the exact same key file with MacOS ssh works fine and permissions on the target directory are fine for writing.

    Please let me know if there’s anything I can do to help you troubleshoot and/or fix this. For myself, the tar workaround is fine, but non-technical users would benefit from a direct sftp upload for sure.

    #7247
    Avatar photo[anonymous]

    I have a similar issue with a server that has a very old ssh/sftp server. It seems that Publii has changed something in the sftp protocol/library between version 0.35.3 and 0.39.1. In the older version the sftp connection works, in the newer it doesn’t. The “Test connection” gives the following Error message:

    Error! Application was able to connect with your server but was unable to store files. Please check file permissions on your server.

    Using scp e.g. from Mobaxterm, the connection works fine. Looking at the sshd logs on the server it says:

    fatal: no kex alg

    It seems that Publii 0.39.1 is more restrictive in the KexAlgorithms allowed. It should allow older kex algorithms like “diffie-hellman-group-exchange-sha1”.  Could you check what has been changed and if this can be reverted? Thanks.

    #7312
    Avatar photo[anonymous]

    Hi,

    I have always test the SFTP deployment with my VPS using my keys and it works. I suppose that this problem is related to the ssh2 library which is used in our SFTP deployment method. I do not see errors relatd to `no kex alg` and I suppose that we will be unable to fix this problem as it is an issue with dependency. So I suppose that always there will be small subset of servers where SFTP deployment method won’t work due a big amount of possible configurations.

    That’s why we have prepared the manual deployment solution. Also in the future we will release a plugin which will allow more advanced users to run their own scripts after rendering a website – but it is a topic for the next few months.

    #9902
    Avatar photo[anonymous]

    I did a comparison with the plain sftp package alone.

    The client is the same MacOS, same account and same ssh key.

    Server is the same OpenBSD, same account.

    The sample program with the package alone authenticates fine and is able to access the server.

    Publii attempting the same fails as described above.

    Could there be something in the configuration object Publii hands out to the library that forces it to use an incompatible algorithm ssh-rsa instead of ssh2 RSA. ?

    npm install ssh2-sftp-client

    let Client = require(‘ssh2-sftp-client’);

    const fs = require(‘fs’);

    let sftp = new Client();

    sftp.connect({

    <span class=”Apple-converted-space”>  </span>host: ‘kb.example.com’,

    <span class=”Apple-converted-space”>  </span>port: ’22’,

    <span class=”Apple-converted-space”>    </span>username: ‘kb’,

    <span class=”Apple-converted-space”>  </span>privateKey: fs.readFileSync(‘/Users/kb/.ssh/id_rsa’)

    }).then(() => {

    <span class=”Apple-converted-space”>  </span>return sftp.list(‘/var/www/htdocs/kb.example.com’);

    }).then(data => {

    <span class=”Apple-converted-space”>  </span>console.log(data, ‘the data info’);

    }).catch(err => {

    <span class=”Apple-converted-space”>  </span>console.log(err, ‘catch error’);

    });

    node sftp.js

    #9905
    Avatar photo[anonymous]

    The difference in behaviour is due to different versions of the ssh2 package.

    Publii builds with version 1.<span class=”x x-first x-last”>11</span>.0 of this package and fails the connections, while the sample code uses version 1.<span class=”x x-first x-last”>12</span>.0 with success.

    I built Publii locally, upgraded this package and Publii server connection test to OpenBSD now succeeds. Please find PR on Github.