Help with SFTP : error “Host key verification failed”

[gio.cot]

Hi All

I’m try to connect via SFTP to a supplier’s server , but I receive the error “Host key verification failed” ;
The supplier told me that “..doing connection tests with your user , the problem described does not occur, there are no keys activated on the server side ..”
I tryed also to run “ssh-keygen -R [hostname|IP address]” , did not solved the problem

This is the log that i collected

sftp -vvv -b /tmp/sftp/DFT_SFTPSRV_SFTP myuser@sftp.SFTPSRV.com
OpenSSH_6.9p1, OpenSSL 1.0.2n 7 Dec 2017
debug1: Reading configuration data /QOpenSys/QIBM/ProdData/SC1/OpenSSH/etc/ssh_config
debug2: ssh_connect: needpriv 0
debug1: Connecting to sftp.SFTPSRV.it [YYY.WW.HHH.ZZ] port 22.
debug1: Connection established.
debug1: key_load_public: No such file or directory
debug1: identity file /home/USER/.ssh/id_rsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/USER/.ssh/id_rsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/USER/.ssh/id_dsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/USER/.ssh/id_dsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/USER/.ssh/id_ecdsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/USER/.ssh/id_ecdsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/USER/.ssh/id_ed25519 type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/USER/.ssh/id_ed25519-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.9
debug1: Remote protocol version 2.0, remote software version OpenSSH_8.0
debug1: match: OpenSSH_8.0 pat OpenSSH* compat 0x04000000
debug2: fd 3 setting O_NONBLOCK
debug1: Authenticating to sftp.SFTPSRV.it:22 as 'myuser'
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug2: kex_parse_kexinit: curve25519-sha256@libssh.xxxxxxxxxx
debug2: kex_parse_kexinit: umac-64-etm@openssh.com,umac-128-zzzzzzzzzz
debug2: kex_parse_kexinit: none,zlib@openssh.com
debug2: kex_parse_kexinit: none,zlib@openssh.com
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit: first_kex_follows 0
debug2: kex_parse_kexinit: reserved 0
debug2: kex_parse_kexinit: curve25519-sha256,curve25519-yyyyyyyy
debug2: kex_parse_kexinit: rsa-sha2-512,rsa-sha2-256,kkkkkkkk
debug2: kex_parse_kexinit: aes256-gcm@openssh.com,chacha20-xxxxxx
debug2: kex_parse_kexinit: aes256-gcm@openssh.jjjjj
debug2: kex_parse_kexinit: hmac-sha2-256-etm@openssh.com,hhhhh
debug2: kex_parse_kexinit: hmac-sha2-256-etm@openssh.iiiiii
debug2: kex_parse_kexinit: none,zlib@openssh.com
debug2: kex_parse_kexinit: none,zlib@openssh.com
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit: first_kex_follows 0
debug2: kex_parse_kexinit: reserved 0
debug1: kex: server->client chacha20-poly1305@openssh.com <implicit> none
debug1: kex: client->server chacha20-poly1305@openssh.com <implicit> none
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ecdsa-sha2-nistp256 SHA256:ddddddd
Host key verification failed.
Connection closed

Which could be the problem ?

Thanks in advance

[gio.cot]

Hi all

I have taken a step forward … running “ ssh myuser@sftp.SFTPSRV.COM”, i was able to create the file known_hosts with the information relative to sftp.SFTPSRV.COM; after that if i try to run “sftp myuser@sftp.SFTPSRV.COM” i receive :
Permission denied, please try again.
Permission denied, please try again.
Permission denied (publickey,gssapi-keyex,gssapi-with-mic,password).
Connection closed
Any suggestion for this messages ?

Thanks in advance
Gio

[Scott Klement]

The error is "Permission denied, please try again." In other words, you do not have authority to one of the IFS files it needs.

The original problem was that none of the key files existed, that's what "No such file or directory" means.... and it says this by each possible key file.

[gio.cot]

Hi Scott
below a new log ..
i don't understand why i find :
debug1: identity file /home/USER/.ssh/id_rsa type 1
debug1: key_load_public: No such file or directory
when if i run wrklnk '/home/user' i see this:

Immagine.png (28.85 KiB) Viewed 8652 times

$
sftp -vvv myuser@sftp.SFTPSRV.it
OpenSSH_6.9p1, OpenSSL 1.0.2n 7 Dec 2017
debug1: Reading configuration data /QOpenSys/QIBM/ProdData/SC1/OpenSSH/etc/ssh_config
debug2: ssh_connect: needpriv 0
debug1: Connecting to sftp.SFTPSRV.it [YYY.WW.HHH.ZZ] port 22.
debug1: Connection established.
debug1: identity file /home/USER/.ssh/id_rsa type 1
debug1: key_load_public: No such file or directory
debug1: identity file /home/USER/.ssh/id_rsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/USER/.ssh/id_dsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/USER/.ssh/id_dsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/USER/.ssh/id_ecdsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/USER/.ssh/id_ecdsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/USER/.ssh/id_ed25519 type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/USER/.ssh/id_ed25519-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.9
debug1: Remote protocol version 2.0, remote software version OpenSSH_8.0
debug1: match: OpenSSH_8.0 pat OpenSSH* compat 0x04000000
debug2: fd 3 setting O_NONBLOCK
debug1: Authenticating to sftp.SFTPSRV.it:22 as 'myuser'
debug3: hostkeys_foreach: reading file "/home/USER/.ssh/known_hosts"
debug3: record_hostkey: found key type ECDSA in file /home/USER/.ssh/known_hosts:1
debug3: load_hostkeys: loaded 1 keys from sftp.SFTPSRV.it
debug3: order_hostkeyalgs: prefer hostkeyalgs: ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecd
sa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug2: kex_parse_kexinit: curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-grou
p-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cer
t-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519-cert-v01@openssh.com,ssh-rsa-cert-v01@open
ssh.com,ssh-dss-cert-v01@openssh.com,ssh-rsa-cert-v00@openssh.com,ssh-dss-cert-v00@openssh.com,ssh-ed25519,ssh-rsa,ssh-dss
debug2: kex_parse_kexinit: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.
com,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se
debug2: kex_parse_kexinit: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.
com,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se
debug2: kex_parse_kexinit: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.
com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5-etm@openssh.co
m,hmac-ripemd160-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,hmac-md5,hmac-ripemd160,hmac-ripemd160@ope
nssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.
com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5-etm@openssh.co
m,hmac-ripemd160-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,hmac-md5,hmac-ripemd160,hmac-ripemd160@ope
nssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: none,zlib@openssh.com
debug2: kex_parse_kexinit: none,zlib@openssh.com
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit: first_kex_follows 0
debug2: kex_parse_kexinit: reserved 0
debug2: kex_parse_kexinit: curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,d
iffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie
-hellman-group-exchange-sha1,diffie-hellman-group14-sha1
debug2: kex_parse_kexinit: rsa-sha2-512,rsa-sha2-256,ssh-rsa,ecdsa-sha2-nistp256,ssh-ed25519
debug2: kex_parse_kexinit: aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes256-ctr,aes256-cbc,aes128-gcm@openssh.com,aes128-
ctr,aes128-cbc
debug2: kex_parse_kexinit: aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes256-ctr,aes256-cbc,aes128-gcm@openssh.com,aes128-
ctr,aes128-cbc
debug2: kex_parse_kexinit: hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512-etm@openss
h.com,hmac-sha2-256,hmac-sha1,umac-128@openssh.com,hmac-sha2-512
debug2: kex_parse_kexinit: hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512-etm@openss
h.com,hmac-sha2-256,hmac-sha1,umac-128@openssh.com,hmac-sha2-512
debug2: kex_parse_kexinit: none,zlib@openssh.com
debug2: kex_parse_kexinit: none,zlib@openssh.com
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit: first_kex_follows 0
debug2: kex_parse_kexinit: reserved 0
debug1: kex: server->client chacha20-poly1305@openssh.com <implicit> none
debug1: kex: client->server chacha20-poly1305@openssh.com <implicit> none
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ecdsa-sha2-nistp256 SHA256:pmoyG2p2bc1qk55vk7wjgzg3pmxlh59rv5dlgewd9jem5nrt4wII
debug3: hostkeys_foreach: reading file "/home/USER/.ssh/known_hosts"
debug3: record_hostkey: found key type ECDSA in file /home/USER/.ssh/known_hosts:1
debug3: load_hostkeys: loaded 1 keys from sftp.SFTPSRV.it
debug3: hostkeys_foreach: reading file "/home/USER/.ssh/known_hosts"
debug3: record_hostkey: found key type ECDSA in file /home/USER/.ssh/known_hosts:1
debug3: load_hostkeys: loaded 1 keys from YYY.WW.HHH.ZZ
debug1: Host 'sftp.SFTPSRV.it' is known and matches the ECDSA host key.
debug1: Found key in /home/USER/.ssh/known_hosts:1
debug2: set_newkeys: mode 1
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug2: set_newkeys: mode 0
debug1: SSH2_MSG_NEWKEYS received
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug2: service_accept: ssh-userauth
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug2: key: /home/USER/.ssh/id_rsa (2003faf0),
debug2: key: /home/USER/.ssh/id_dsa (0),
debug2: key: /home/USER/.ssh/id_ecdsa (0),
debug2: key: /home/USER/.ssh/id_ed25519 (0),
debug3: input_userauth_banner
**********************************************************************************
** WARNING: **
** **
** THE PROGRAMS AND DATA HELD ON THIS SYSTEM ARE THE PROPERTY OF AND LICENSED **
** BY SFTPSRV SDS EUROPE **
** **
** IF THE COMPANY HAS NOT AUTHORIZED ACCESS TO THIS SYSTEM YOU WILL BE **
** COMMITTING A CRIMINAL OFFENCE IF YOU DO NOT IMMEDIATELY DISCONNECT **
** **
** UNAUTHORIZED ACCESS IS STRICTLY FORBIDDEN AND A DISCIPLINARY OFFENCE **
** **
**********************************************************************************
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug3: start over, passed a different list publickey,gssapi-keyex,gssapi-with-mic,password
debug3: preferred publickey,keyboard-interactive,password
debug3: authmethod_lookup publickey
debug3: remaining preferred: keyboard-interactive,password
debug3: authmethod_is_enabled publickey
debug1: Next authentication method: publickey
debug1: Offering RSA public key: /home/USER/.ssh/id_rsa
debug3: send_pubkey_test
debug2: we sent a publickey packet, wait for reply
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug1: Trying private key: /home/USER/.ssh/id_dsa
debug3: no such identity: /home/USER/.ssh/id_dsa: No such file or directory
debug1: Trying private key: /home/USER/.ssh/id_ecdsa
debug3: no such identity: /home/USER/.ssh/id_ecdsa: No such file or directory
debug1: Trying private key: /home/USER/.ssh/id_ed25519
debug3: no such identity: /home/USER/.ssh/id_ed25519: No such file or directory
debug2: we did not send a packet, disable method
debug3: authmethod_lookup password
debug3: remaining preferred: ,password
debug3: authmethod_is_enabled password
debug1: Next authentication method: password
debug1: read_passphrase: can't open /dev/tty: No such device or address
debug2: readpassphrase: not a 5250 return ENOTTY
debug2: we sent a password packet, wait for reply
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
Permission denied, please try again.
debug1: read_passphrase: can't open /dev/tty: No such device or address
debug2: readpassphrase: not a 5250 return ENOTTY
debug2: we sent a password packet, wait for reply
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
Permission denied, please try again.
debug1: read_passphrase: can't open /dev/tty: No such device or address
debug2: readpassphrase: not a 5250 return ENOTTY
debug2: we sent a password packet, wait for reply
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug2: we did not send a packet, disable method
debug1: No more authentication methods to try.
Permission denied (publickey,gssapi-keyex,gssapi-with-mic,password).
Connection closed
$

[Scott Klement]

I don't know. I haven't had that problem before. Maybe the permissions on the files are wrong?