sftp passwordless

[JackDettoLoco]

Hello everyone,

As a non-technical user, I need to backup terabytes of data from an Ubuntu PC to an Asustor AS6210T. I've connected the two devices with an Ethernet cable and configured the connection to use RSA keys instead of asking for a password. Currently, I can access the NAS passwordless via SSH and SFTP using the following address: [email protected]:/volume3.

I installed Restic using the command: sudo apt install restic, and then installed Backrest with ./install.sh.

I attempted to create a new repository through the graphical interface but encountered an error. I configured it as follows:

• Repo name = Prova
• Repository URL = sftp://[email protected]:/volume3/NAS
• Password = Prova

The error message I received is as follows:

Operation failed: [unknown] failed to init repo: init failed: command "/home/giacomo/.local/share/backrest/restic-0.16.4 init --json -o sftp.args=-oBatchMode=yes" failed: exit status 1 Process STDOUT: subprocess ssh: [email protected]: Permission denied (publickey,keyboard-interactive). Fatal: create repository at sftp://[email protected]:/volume3/NAS failed: unable to start the sftp session, error: error receiving version packet from server: server unexpectedly closed connection: unexpected EOF

I then added the flag -o sftp.ssh_argument="-i /home/giacomo/.ssh/id_rsa", but encountered another error:

Operation failed: [unknown] failed to init repo: init failed: command "/home/giacomo/.local/share/backrest/restic-0.16.4 init --json -o sftp.ssh_argument=-i /home/giacomo/.ssh/id_rsa -o sftp.args=-oBatchMode=yes" failed: exit status 1 Process STDOUT: Fatal: create repository at sftp://[email protected]:/volume3/NAS failed: Fatal: option sftp.ssh_argument is not known

I then suspected that Restic might be installed incorrectly, but the following command successfully creates the repository, only prompting for the password:

restic -r sftp:[email protected]:/volume3/NAS init

This indicates that the RSA key is being read successfully.

I'm sure I'm missing some basic concept here, but I can't figure out where I'm going wrong.

[garethgeorge]

Hey, sorry about that -- looks like you ran afoul of a typo on the docs. I'm not at my computer right now to try this out but I believe the ssh flag you need for your identity file should be -o sftp.args="-i /path/to/key".

[JackDettoLoco]

It worked. Thank you so much. I found the wrong command in the 'Flags' section of this page: https://garethgeorge.github.io/backrest/introduction/getting-started

But we find a new error:
Operation failed: [unknown] failed to init repo: init failed: command "/home/giacomo/.local/share/backrest/restic-0.16.4 init --json -o sftp.args=-i /home/giacomo/.ssh/id_rsa" failed: exit status 1 Process STDOUT: subprocess ssh: [email protected]: Permission denied (publickey,keyboard-interactive). Fatal: create repository at sftp://[email protected]:/volume1/home/Giacomo/NAS failed: unable to start the sftp session, error: error receiving version packet from server: server unexpectedly closed connection: unexpected EOF

I tried to run: sftp [email protected]:/volume1/home/Giacomo/NAS from terminal and everything is ok.
Connected to 169.254.1.2.
Changing to: /volume1/home/Giacomo/NAS

This work with no prob:
restic -r sftp://[email protected]:/volume1/home/Giacomo/NAS init

Maybe there are same bad permission? i check id_rsa permission and i set it to chmod 600. nothing change.

I paste here the NAS sshd_config file:

"
# Package generated configuration file
# See the sshd_config(5) manpage for details

# What ports, IPs and protocols we listen for
Port 22
# Use these options to restrict which interfaces/protocols sshd will bind to
#ListenAddress ::
#ListenAddress 0.0.0.0
Protocol 2
# HostKeys for protocol version 2
#HostKey /usr/etc/ssh/ssh_host_rsa_key
#HostKey /usr/etc/ssh/ssh_host_dsa_key
#HostKey /usr/etc/ssh/ssh_host_ecdsa_key
#Privilege Separation is turned on for security
#UsePrivilegeSeparation yes

# Lifetime and size of ephemeral version 1 server key
#KeyRegenerationInterval 3600
#ServerKeyBits 768

# Logging
SyslogFacility AUTH
LogLevel INFO

# Authentication:
LoginGraceTime 120
PermitRootLogin yes
StrictModes yes

RSAAuthentication yes
PubkeyAuthentication yes
AuthorizedKeysFile	%h/.ssh/authorized_keys

# Don't read the user's ~/.rhosts and ~/.shosts files
IgnoreRhosts yes
# For this to work you will also need host keys in /usr/etc/ssh_known_hosts
#RhostsRSAAuthentication no
# similar for protocol version 2
HostbasedAuthentication no
# Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication
#IgnoreUserKnownHosts yes

# To enable empty passwords, change to yes (NOT RECOMMENDED)
PermitEmptyPasswords no

# Change to yes to enable challenge-response passwords (beware issues with
# some PAM modules and threads)
ChallengeResponseAuthentication yes

# Change to no to disable tunnelled clear text passwords
PasswordAuthentication no

# Kerberos options
#KerberosAuthentication no
#KerberosGetAFSToken no
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes

# GSSAPI options
#GSSAPIAuthentication no
#GSSAPICleanupCredentials yes

X11Forwarding yes
X11DisplayOffset 10
PrintMotd no
PrintLastLog yes
TCPKeepAlive yes
#UseLogin no

#MaxStartups 10:30:60
#Banner /usr/etc/issue.net

# Allow client to pass locale environment variables
AcceptEnv LANG LC_*

Subsystem sftp /usr/bin/sftp-server

# Set this to 'yes' to enable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
# be allowed through the ChallengeResponseAuthentication and
# PasswordAuthentication.  Depending on your PAM configuration,
# PAM authentication via ChallengeResponseAuthentication may bypass
# the setting of "PermitRootLogin without-password".
# If you just want the PAM account and session checks to run without
# PAM authentication, then enable this but set PasswordAuthentication
# and ChallengeResponseAuthentication to 'no'.

# ADM4_WORKAROUND
#UsePAM yes
UsePAM yes
UseDNS no

#Ciphers aes128-ctr,aes192-ctr,aes256-ctr
#MACs hmac-sha1,hmac-ripemd160
"

[garethgeorge]

I don't use SFTP on any of my devices -- but my understanding is that there are some finicky issues w/restic and how the SFTP URI is provided. https://forum.restic.net/t/cant-init-a-new-sftp-repo/885 may be related to your problem.

It sounds like your repository should be sftp:[email protected]:/volume1/home/Giacomo/NAS (note the removed double // at the front).

If that works please go ahead and report back with the working config! I'd like to make a series of wiki entries covering the common restic remotes and pitfalls https://garethgeorge.github.io/backrest/

[JackDettoLoco]

Nothing change.
error:
Operation failed: [unknown] failed to init repo: init failed: command "/home/giacomo/.local/share/backrest/restic-0.16.4 init --json -o sftp.args=-i /home/giacomo/.ssh/id_rsa" failed: exit status 1 Process STDOUT: subprocess ssh: [email protected]: Permission denied (publickey,keyboard-interactive). Fatal: create repository at sftp:[email protected]:/volume1/Giacomo/NAS failed: unable to start the sftp session, error: error receiving version packet from server: server unexpectedly closed connection: unexpected EOF

using restic i setup and run 2 different backup via sftp and everything work fine (passworless).

:-(

[kinghat]

did you get this working? im currently trying to do this from within a container and am getting this as well:

unable to start the sftp session, error: error receiving version packet from server: server unexpectedly closed connection: unexpected EOF

[JackDettoLoco]

not yet :(

[kinghat]

i think the issue here is that the container is being run as root and doesnt match the user of the remote sftp host which can be done by adding the flag: -o sftp.args="-l username"

im not sure what the implications would be of running this container as user vs root 🤔 if there are no issues in that regard i would suggest making that the suggested default for docker/compose.

another thing is mounting your key into the container. this is one way to get sftp working but another way is to have the container generate ssh keys for you, add it to your data dir, and present the pub key on the frontend. you would then just need to add that key to your remote hosts known_hosts file.

[provolik]

Hello, my situation is similar, but I do not use docker.

If I run backrest from command line SFTP config works like a charm. If I install it, it's not working anymore: it gives me authentication issue like jack and if I add the ssh key file with the -i param it returns me a libcrypto error.

Maybe it's a user problem, but is there a way to fix it?

Thanks

[matteoveglia]

I grew tired of trying to fix this so I just used the rclone backend and it worked first time, not a single issue

[madmalkav]

I got sftp repo to work from Docker.

Password on the repo config is the password you will use for restic, not the SFTP password. This single misunderstanding made me lose hours :( You have to use ssh keys, no way to use sftp with password for what I could see.

If you use Docker, you need to have TTY enabled. I run docker from Truenas Scale and it has an UI with a "Enable TTY" checkbox, dunno how it works on other environments.

You cannot set custom sftp args or you will get an error (see #165)

[garethgeorge]

Added a few more debugging notes here: #278 (comment), to copy over some of the content from that discussion:

General advice is to setup by first docker exec -it <your container> bash to get a shell in the backrest container, and then crafting an ssh command on that bash shell that works to connect to your target machine.

Whether using sftp.args OR sftp.command, it is important that you include -oBatchMode=yes as this will prevent the SSH process from blocking for input when encountering an error (e.g. running into the password prompt on the remote system). This can be very problematic when trying to debug access issues etc as commands will appear to simply hang without completing.

See the linked comment for a few notes re: sftp.command usage, I suspect this is the easiest way to setup sftp.

[gurabli]

I just installed Backrest and doing my tests over SFTP. Of course, I came across the issue of the sftp password. Here is how I managed to solve this.
I'm running the docker version on my home server (linux). From the host I did the SSH key authentication between my home server and the remote server. Tested the connection, works fine.
Then I just added a volume mount to Backrest docker compose to mount the host authorized_keys and works perfectly fine -- note the read only flag (:ro).

    volumes:
      - /home/<USER>/.ssh:/root/.ssh:ro

Restart Backrest and there you go with the sftp connection without password with all your hosts that are already enabled with auth keys.