I'm testing the restoration of a backup with duplicity 0.6.15.

I can login to my backup server just fine using ssh and sftp using the following commands and my private key:


root@client:~# sftp -oPort=7843 [email protected]
Enter passphrase for key '/root/.ssh/id_rsa':
Connected to 192.168.x.x
sftp> exit


root@client:~# ssh -p7843 [email protected]
Enter passphrase for key '/root/.ssh/id_rsa':
Connected to 192.168.x.x
Last Login: ....

I have the following restore script used to restore the contents of the signed and encrypted backup:

export SIGN_PASSPHRASE='<signed-key-passphrase'
export PASSPHRASE='<encryption-passphrase>'

duplicity -v9 --encrypt-key="<encryption-key-id>" --sign-key="<signed-key-id>" --force \
scp://b[email protected]:7843//home/backupUser/backup /mnt/restore

However when I run the script duplicity:

root@client~#: ./restore_script.sh

Duplicity gives me the following error when duplicity uses it to attempt to login to my backup server:

Using archive dir: /root/.cache/duplicity/b1a470f45b67cd7784bc8e6449383df7
Using backup name: b1a470f45b67cd7784bc8e6449383df7
Import of duplicity.backends.hsibackend Succeeded
Import of duplicity.backends.ftpbackend Succeeded
Import of duplicity.backends.botobackend Succeeded
Import of duplicity.backends.rsyncbackend Succeeded
Import of duplicity.backends.imapbackend Succeeded
Import of duplicity.backends.localbackend Succeeded
Import of duplicity.backends.giobackend Succeeded
Import of duplicity.backends.ftpsbackend Succeeded
Import of duplicity.backends.cloudfilesbackend Succeeded
Import of duplicity.backends.gdocsbackend Succeeded
Import of duplicity.backends.tahoebackend Succeeded
Import of duplicity.backends.u1backend Succeeded
Import of duplicity.backends.webdavbackend Succeeded
Import of duplicity.backends.sshbackend Succeeded
Main action: restore
duplicity 0.6.15 (August 19, 2011)
Args: /usr/bin/duplicity -v9 --encrypt-key=<encryption-key-id> --sign-key=<signature-key-id> --force scp://[email protected]:7843//home/backupUser/backup /mnt/restore
Linux client 3.0.0-12-generic #20-Ubuntu SMP Fri Oct 7 14:50:42 UTC 2011 i686 i686
/usr/bin/python 2.7.2+ (default, Oct  4 2011, 20:03:08) 
[GCC 4.6.1]
Using temporary directory /tmp/duplicity-sLukkP-tempdir
Registering (mkstemp) temporary file /tmp/duplicity-sLukkP-tempdir/mkstemp-12JD0o-1
Temp has 4995375104 available, backup will use approx 34078720.
Running 'sftp  -oPort=7843 -oServerAliveInterval=15 -oServerAliveCountMax=2 [email protected]' (attempt #1)
State = sftp, Before = 'Enter'
State = sftp, Before = ''
Invalid SSH password
Running 'sftp  -oPort=7843 -oServerAliveInterval=15 -oServerAliveCountMax=2 [email protected]' failed (attempt #1)
Removing still remembered temporary file /tmp/duplicity-sLukkP-tempdir/mkstemp-12JD0o-1
INT intercepted...exiting.

I have a public key in my .ssh directory, and it should allow duplicity to login using that rather than asking for an ssh-password (which I have turned off on the server anyway), so I don't understand why the server is not allowing duplicity to login.

Here's my client's listing of the .ssh directory, permissions and all:

root@client:~# ls -la /root/.ssh
total 16
drwx------ 2 root root 4096 2011-11-29 01:05 .
drwx------ 8 root root 4096 2011-11-29 12:30 ..
-rw------- 1 root root 1766 2011-11-29 01:06 id_rsa
-rw-r--r-- 1 root root  442 2011-11-29 00:38 known_hosts

Is there something I'm missing? I got the backup to work just fine, and I'd like to test out restoring the backup before sealing the deal here and saying that it works.

  • I even tried adding '--ssh-options="-oIdentityFile=/root/.ssh/id_rsa"' to the args... and I still get the same error.
    – leeand00
    Nov 30, 2011 at 5:32
  • I noticed that sftp asked me for the Passphrase to my private ssh key when I was trying to login, so why is it that duplicity doesn't use my key and just craps out instead?
    – leeand00
    Nov 30, 2011 at 16:25

1 Answer 1


Okay, I figured it out. In order for duplicity to enter the passphrase for the ssh key, (not for the gpg encryption-key), keychain must be installed and configured, and the key must be added using the ssh-add command.

I needed to install keychain, so I did,

and then add I added it to my .bash_profile like so:

keychain --clear id_rsa
. ~/.keychain/$HOSTNAME-sh

Now assuming my public key is stored along with my private key in the /root/.ssh directory, when I switch users to root I first get an error, but after that I run ssh-add, exit out of the account, and log back in as root again.

When I return to the root account, I am asked for the ssh private key's passphrase. Now duplicity appears to work... as far as connecting to the other server anyway... I no longer get the Invalid SSH Password message I was getting earlier.

  • Even got the decryption working now woo!
    – leeand00
    Nov 30, 2011 at 19:56
  • @fuscata I will. In a little over 17 hours according to the site.
    – leeand00
    Dec 1, 2011 at 1:18
  • I'm still a little unhappy with the results though as everytime I login I have to re-run the ssh-add command. As a hack it can be added to the end of .bash_profile, but it seems like this is the wrong thing to do...
    – leeand00
    Dec 1, 2011 at 1:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .