Connection problems with SFTP

[Fred K. Abell Jr._1]

Greetings:

Running HP-UX 11.11 v1 on J6750 workstation, MTOE from 12/06, with Support Plus from 6/09

I am having an unusual sftp problem. From a XP box, I use SSH Secure Shell v3.1.0 (GUI) from SSH Communications Security Corp., to my HP-UX workstations. This version is the non-commercial version that does not support PKI or PKCS #11.

In the past, I have been able to sftp to workstations without problems. But now, when I make the connection, after being prompted for username and password, the connection hangs.

Using Wireshark, the handshake seems to be working.

I have downloaded and installed the latest version of Secure Shell from software.hp.com (even though a version exists with the install). I do this to keep the system up to date with the most current version, product # T1471AA. On an older machine, the T1471AA is version A.04.70.003, which works fine. The latest version is A.05.30.007, and it is the one I am having problems with.

As a test, I made a clean install, no patches, upgrades, or hardening, and I was able to connect via sftp. I installed the latest T1471AA version, and was still able to connect, but the connection just doesn’t finish and hangs there. I get the same problem with version A.05.00.024 on a third machine.

Any assistance would be appreciated. Thanks in advance.

Fred

[Horia Chirculescu]

Hello, Fred.

You could get some more info by increasing debugging level in your sftp client (sftp -d I believe).

Also, you should try to make a simple ssh connection to see what it is going on. Use ssh -vv

Best regards from Romania,
Horia

[Fred K. Abell Jr._1]

Horia,

Those options are not really possible. The client is running from Windows XP, using a GUI. There is no command line option. I have look for a way to modify the GUI, to no avail.

I have not had problems connecting from other UNIX boxes, just from XP.

Fred

[Matti_Kurkela · Accepted solution]

The SSH.com Secure Shell v3.1.0? I think that's a pretty old version, with plenty of known bugs. Even the 3.2.* series is old now. If possible, try to upgrade your client.

Get a free WinSCP GUI client from http://winscp.net/ and test with it too.

The A.05.* series of T1471AA is based on OpenSSH 5.0. and above. After A.04.70.003 / OpenSSH 4.7, a new SFTP protocol option was introduced:
http://www.openssh.com/txt/release-4.9
----
* Added a protocol extension method "posix-rename@openssh.com" for sftp-server(8) to perform POSIX atomic rename() operations (bz#1400)
----

My first guess would be that the SFTP component of the old SSH.com Secure Shell v3.1.0 might get confused by this new option. If it could just say "no, I don't support that option" in the option negotiation phase, the server side would handle that just fine.

To confirm that, a debug log from the sshd would probably be useful.

See also "man sftp-server" for instructions on how to increase the log level of the sftp-server subsystem.

A bug report (with the debug logs included) to HP or directly to openssh.com folks would probably allow the implementation of a server-side workaround. Something like "if the client reports its version as 'ssh.com v3.1.0', don't even bother offering these protocol extensions".

MK

[Horia Chirculescu]

Hello Fred,

Matti Kurkela has pointed you to a right direction.

WinSCP has an option to perform debugging.

See Session/Logging enable logging (select .txt log) and then set debugging level (Logging level) at Debug2.

This way, you should know for sure if your sftp client (never worked with this client that you use)is the problem.

WinSCP is free and reliable. I use version 4.2.4 and it is working great (at least since some while...). Of course you should get the latest version availlable.

Best regards,
Horia.

[Steven E. Protter]

Shalom,

Seems to me like a server issue.

The HP-UX version of Secure shell is a very early opensssh 5.x port and should be upgraded after reading the notes.

http://software.hp.com

Not much help to be offered on the Windows side, other thant he fact that a product based on a version of openssh closer to that running on the HP-UX servers is more likely to work.

SEP

[Fred K. Abell Jr._1]

The WinSCP worked very nicely. Thanks all.
Fred