3

I'm trying to setup a backup system with Duplicity. I have a server that I want to backup to another SFTP server.

If I try to connect via sftp it works fine:

    root@SERVER:~# sftp user@SFTP_IP
    user@SFTP_IP's password: 
    Connected to SFTP_IP.
    sftp>

But when I try using Duplicity:

    root@SERVER:~# duplicity /etc sftp://user@SFTP_IP//
    BackendException: ssh connection to SFTP_IP:22 failed: Unknown server SFTP_IP

I've tried following the only instructions regarding this problem I found on the net: http://tom.meinlschmidt.org/2014/04/24/duplicity-backendexception-ssh-connection-to-server22-failed-unknown-server/

However it didn't work and since the author gives almost no details about what causes the issue, only that's it's probably paramiko, I cannot figure out what to do.

My configuration is as follows:

    root@SERVER:~# lsb_release -a
    No LSB modules are available.
    Distributor ID: Debian
    Description:    Debian GNU/Linux 7.7 (wheezy)
    Release:    7
    Codename:   wheezy

    root@SERVER:~# ssh -V
    OpenSSH_6.0p1 Debian-4+deb7u2, OpenSSL 1.0.1e 11 Feb 2013

    root@SERVER:~# duplicity -V
    duplicity 0.6.18

    root@SERVER:~# python -c "import paramiko; print paramiko.__version__"
    1.7.7.1 (George)

EDIT1: Ok the problem doesn't seem to come strictly from paramiko since a simple paramiko sftp demo program from 2013 (github-link) manages to connect just fine.

EDIT2: I had this problem on a server with an almost brand-new install of Wheezy, I installed an Ubuntu 14.04 (with OpenSSH_6.6.1p1 and paramiko 1.10.1) on it and Duplicity (0.6.23) works fine.

1
  • Duplicity does not seem to support specific ports despite talking about it in their documentation.... Jun 9, 2015 at 17:41

3 Answers 3

2

Ok, I have fooled around some more with the python code. @lxio you are right, this is not really a bug from Paramiko or Duplicity but it seems the known_hosts system seems to be a bit inconsistent (and unclear), but I finally got it working.

I used ssh myhost -p 2323 to accept the signature, but this method does not seem to store the specific port value in the known_hosts list (thus is Paramiko refusing to connect, because it thinks the fingerprint is of myhost:21. I have still no correct to add the key via bash, but I know how to add the fingerprint to the known_hosts file via Paramiko to ensure it will connect to the correct host in the future.

We are going to add the key via Paramiko to the known_hosts file:

  1. Edit /usr/share/pyshared/duplicity/backends/sshbackend.py:

Add before keyfilename=None:

self.client.load_host_keys("/root/.ssh/known_hosts")
self.client.set_missing_host_key_policy(paramiko.AutoAddPolicy())

(/root/ is the userdir here, this might be different for you).

  1. Execute a sync commando with Duplicity (where you use the host). Now Paramiko will add the ssh fingerprint to your known_hosts.

  2. Remove all edits you made to your sshbackend.py and save the file.

You can verify it by using cat /root/.ssh/known_hosts. You will see [myhost]:2323 ssh-rsa ....

1
  • I was entirely dubious in attempting this hack-y fix... but it worked like a charm. I'm delightfully astounded! Thanks for going to all the trouble, and especially for sharing the fix. Jul 26, 2015 at 2:22
0

that can happen if the server is not in your .ssh/known_hosts file. simply log in one time via ssh and agree to add it and the error will vanish.

2
  • But if he successfully connected to the same server with sftp beforehand, then an unknown host key does not sound like a likely explanation.
    – kasperd
    Mar 4, 2015 at 22:31
  • Like kasped guessed this is not what my problem is about, I can ssh and sftp just fine on the SFTP machine from the server but duplicity still won't work.
    – Ixio
    Mar 5, 2015 at 8:47
0

Please remember that is a hack, since you will accept any fingerprint of the host

Maybe a bit late but as I encountered the problem myself: it's a bug in paramiko and still not fixed...

You need to manually patch duplicity (file /usr/share/pyshared/duplicity/backends/sshbackend.py):

--- sshbackend.py.orig  2012-04-10 12:32:27.000000000 +1000
+++ sshbackend.py       2012-04-10 12:38:10.000000000 +1000
@@ -127,6 +127,10 @@
         if (m!=None):
             keyfilename=m.group(1)

+        # workaround for #668239 in paramiko: port!=22 causes key lookup to fail
+        # but the default policy is to reject unknown keys...
+        self.client.set_missing_host_key_policy(paramiko.WarningPolicy())
+
         if parsed_url.port:
             portnumber=parsed_url.port
         else:

Source: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=668229

1
  • Have you tried the script from my link in EDIT1? I'm not sure if it's really a bug from Paramiko or a change in the API that wasn't followed by Duplicity. If I have the time I'll try to remake my original config so I can check your solution.
    – Ixio
    Jun 10, 2015 at 14:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .