Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm testing the restoration of a backup with duplicity 0.6.15.

I can login to my backup server just fine using ssh and sftp using the following commands and my private key:


root@client:~# sftp -oPort=7843 backupUser@192.168.x.x
Enter passphrase for key '/root/.ssh/id_rsa':
Connected to 192.168.x.x
sftp> exit


root@client:~# ssh -p7843 backupUser@192.168.x.x
Enter passphrase for key '/root/.ssh/id_rsa':
Connected to 192.168.x.x
Last Login: ....

I have the following restore script used to restore the contents of the signed and encrypted backup:

export SIGN_PASSPHRASE='<signed-key-passphrase'
export PASSPHRASE='<encryption-passphrase>'

duplicity -v9 --encrypt-key="<encryption-key-id>" --sign-key="<signed-key-id>" --force \
scp://backupUser@192.168.x.x:7843//home/backupUser/backup /mnt/restore

However when I run the script duplicity:

root@client~#: ./

Duplicity gives me the following error when duplicity uses it to attempt to login to my backup server:

Using archive dir: /root/.cache/duplicity/b1a470f45b67cd7784bc8e6449383df7
Using backup name: b1a470f45b67cd7784bc8e6449383df7
Import of duplicity.backends.hsibackend Succeeded
Import of duplicity.backends.ftpbackend Succeeded
Import of duplicity.backends.botobackend Succeeded
Import of duplicity.backends.rsyncbackend Succeeded
Import of duplicity.backends.imapbackend Succeeded
Import of duplicity.backends.localbackend Succeeded
Import of duplicity.backends.giobackend Succeeded
Import of duplicity.backends.ftpsbackend Succeeded
Import of duplicity.backends.cloudfilesbackend Succeeded
Import of duplicity.backends.gdocsbackend Succeeded
Import of duplicity.backends.tahoebackend Succeeded
Import of duplicity.backends.u1backend Succeeded
Import of duplicity.backends.webdavbackend Succeeded
Import of duplicity.backends.sshbackend Succeeded
Main action: restore
duplicity 0.6.15 (August 19, 2011)
Args: /usr/bin/duplicity -v9 --encrypt-key=<encryption-key-id> --sign-key=<signature-key-id> --force scp://backupUser@192.168.x.x:7843//home/backupUser/backup /mnt/restore
Linux client 3.0.0-12-generic #20-Ubuntu SMP Fri Oct 7 14:50:42 UTC 2011 i686 i686
/usr/bin/python 2.7.2+ (default, Oct  4 2011, 20:03:08) 
[GCC 4.6.1]
Using temporary directory /tmp/duplicity-sLukkP-tempdir
Registering (mkstemp) temporary file /tmp/duplicity-sLukkP-tempdir/mkstemp-12JD0o-1
Temp has 4995375104 available, backup will use approx 34078720.
Running 'sftp  -oPort=7843 -oServerAliveInterval=15 -oServerAliveCountMax=2 backupUser@192.168.x.x' (attempt #1)
State = sftp, Before = 'Enter'
State = sftp, Before = ''
Invalid SSH password
Running 'sftp  -oPort=7843 -oServerAliveInterval=15 -oServerAliveCountMax=2 backupUser@192.168.x.x' failed (attempt #1)
Removing still remembered temporary file /tmp/duplicity-sLukkP-tempdir/mkstemp-12JD0o-1
INT intercepted...exiting.

I have a public key in my .ssh directory, and it should allow duplicity to login using that rather than asking for an ssh-password (which I have turned off on the server anyway), so I don't understand why the server is not allowing duplicity to login.

Here's my client's listing of the .ssh directory, permissions and all:

root@client:~# ls -la /root/.ssh
total 16
drwx------ 2 root root 4096 2011-11-29 01:05 .
drwx------ 8 root root 4096 2011-11-29 12:30 ..
-rw------- 1 root root 1766 2011-11-29 01:06 id_rsa
-rw-r--r-- 1 root root  442 2011-11-29 00:38 known_hosts

Is there something I'm missing? I got the backup to work just fine, and I'd like to test out restoring the backup before sealing the deal here and saying that it works.

share|improve this question
I even tried adding '--ssh-options="-oIdentityFile=/root/.ssh/id_rsa"' to the args... and I still get the same error. – leeand00 Nov 30 '11 at 5:32
I noticed that sftp asked me for the Passphrase to my private ssh key when I was trying to login, so why is it that duplicity doesn't use my key and just craps out instead? – leeand00 Nov 30 '11 at 16:25
up vote 1 down vote accepted

Okay figured it out. In order for duplicity to enter the passphrase for the ssh key, (not for the gpg encryption-key), keychain must be installed and configured, and the key must be added using the ssh-add command.

I needed to install keychain, so I did,

and then add I added it to my .bash_profile like so:

keychain --clear id_rsa
. ~/.keychain/$HOSTNAME-sh

Now assuming my public key is stored along with my private key in the /root/.ssh directory, when I switch users to root I first get an error, but after that I run shh-add, exit out of the account, and log back in as root again.

When I return to the root account, I am asked for the ssh private key's passphrase. Now duplicity appears to far as connecting to the other server anyway...I no longer get the Invalid SSH Password I was getting earlier.

share|improve this answer
Even got the decryption working now woo! – leeand00 Nov 30 '11 at 19:56
Please accept your answer. – xofer Nov 30 '11 at 20:21
@fuscata I will. In a little over 17 hours according to the site. – leeand00 Dec 1 '11 at 1:18
I'm still a little unhappy with the results though as everytime I login I have to re-run the ssh-add command. As a hack it can be added to the end of .bash_profile, but it seems like this is the wrong thing to do... – leeand00 Dec 1 '11 at 1:20

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.