Re: Problems with remote repository access via sftp

On 06/11/2022 23:04, Martin Michel wrote:
> Hi Denis,
> 
>> back to dar, I found and fixed several issues:
> 
> Thank you and sorry for my delayed answer, I have not found the time to
> deal with it until today.
> 

no worries at all,

> So I tested with the new 2.7.8.RC3 but still without success.
> 
> First the good news:
> 
>> * first the self test error reported at "mycurl_easyhandle_node.cpp
>>    line 176". It was a wrong implicit type conversion in libdar nothing
>>    that hit this self test --- there is a lot in libdar --- before
>>   calling libcurl.
> 
>> * I also fixed the double slash after the hostname, so the URL send to
>> libcurl are correct (even if, so far, it did not hurt having double slash).
>> * last I have surfaces the libcurl version when you list dar's version,
>> for you can seen which libcurl is used in dar_static and which is grab
>> from the OS when using dynamically linked dar.
> 
> Yep, this all works well and is helpful for debugging the reason why I
> still cannot connect to my sftp share.
> 
> I still have two cases, one for my local machine running Void Linux and
> one for a VPS running Debian.
> I tested on both with `dar_static`.
> 
> On my local machine, I get a segfault both with and without running with
> -afile-auth.

OK, I will try to reproduce this segfault under Void Linux.

> 
> On Debian, things are better in a way that I get now the libcurl debug
> messages.
> The problems seems to be a failure in establishing a ssh connection.
> Here is the output:
> 
> ```
> $ ./dar_static_2.7.8.RC3_x86_64_GNU_Linux -avc -l sftp://****@****.your-storagebox.de/archives/server4you/first
> Please provide the password for login **** at host ****.your-storagebox.de:
> repository parameters passed to libcurl:
> hostname      : ****.your-storagebox.de
> port          :
> login         : ****
> password      : (hidden)
> base URL      : sftp://****.your-storagebox.de/
> Asking libcurl to read directory content at sftp://****.your-storagebox.de/archives/server4you/
> *   Trying 2a01:4f8:***:22...
> * Connected to ****.your-storagebox.de (2a01:4f8:***) port 22 (#0)
> * Found host ****.your-storagebox.de in /home/martin/.ssh/known_hosts
> * Set "ecdsa-sha2-nistp521" as SSH hostkey type
> * Failure establishing ssh session: -5, Unable to exchange encryption keys

This seems to be the type of SSH hostkey that libcurl cannot handle. You 
could bypass the known_host check of ssh/sftp by setting the 
environement variable DAR_SFTP_KNOWNHOSTS_FILE

export DAR_SFTP_KNOWNHOSTS_FILE

libdar will then not ask libcurl to check for knowhost (this opens a 
possible man-in-the-middle type of attack, but if you are OK to test 
that, this would validate this hypothesis).

> * Closing connection 0
> Error met while looking for slices: Error met while performing action on libcurl handle: Failed initialization, aborting
> Asking libcurl to read directory content at sftp://****.your-storagebox.de/archives/server4you/
> * Hostname ****.your-storagebox.de was found in DNS cache
> *   Trying 2a01:4f8:***:22...
> * Connected to ****.your-storagebox.de (2a01:4f8:***) port 22 (#1)
> * Found host ****.your-storagebox.de in /home/martin/.ssh/known_hosts
> * Set "ecdsa-sha2-nistp521" as SSH hostkey type
> * Failure establishing ssh session: -5, Unable to exchange encryption keys
> * Closing connection 1
> Error met while looking for slices: Error met while performing action on libcurl handle: Failed initialization, aborting
> No backup file is present in sftp://****.your-storagebox.de/archives/server4you for archive first, please provide the last file of the set. [return = YES
> | Esc = NO]
> No backup file is present in sftp://****.your-storagebox.de/archives/server4you for archive first, please provide the last file of the set. [return = YES
> | Esc = NO]
> Escaping...
> Final memory cleanup...
> Aborting program. User refused to continue while asking: No backup file is present in sftp://****.your-storagebox.de/archives/server4you for archive first
> , please provide the last file of the set.
> ```
> 
> I have no problems to connect and list the sftp content with curl using
> this version though:
> 
> ```
> $ curl -V
> curl 7.74.0 (x86_64-pc-linux-gnu) libcurl/7.74.0 OpenSSL/1.1.1n zlib/1.2.11 brotli/1.0.9 libidn2/2.3.0 libpsl/0.21.0 (+libidn2/2.3.0) libssh2/1.9.0 nghttp2/1
> .43.0 librtmp/2.3

AFAIK, libcurl relies on libssh2 for ssh/sftp stuff. Here this is 
libssh2/1.9.0, I have an older one so I will upgrade and see.

> Release-Date: 2020-12-09
> Protocols: dict file ftp ftps gopher http https imap imaps ldap ldaps mqtt pop3 pop3s rtmp rtsp scp sftp smb smbs smtp smtps telnet tftp
> Features: alt-svc AsynchDNS brotli GSS-API HTTP2 HTTPS-proxy IDN IPv6
> Kerberos Largefile libz NTLM NTLM_WB PSL SPNEGO SSL TLS-SRP UnixSockets
> ```
> 
> I could not yet dig deeper into it, and why it could not exchange
> encryption keys.
> Maybe it is really related to my remote sftp configuration.

... or to the libssh version I used... let me double check first.

> 
> Can you connect to a remote sftp share in general?

Yes I can

> 
> Best regards,
> Martin
> 

Cheers,
Denis