WinSCP sporadically fails on Host key does not match when connecting through tunnel :: Support Forum

DotnetDeveloper
Joined:: 2021-03-24
Posts:: 6
Location:: Virginia

WinSCP sporadically fails on Host key does not match when connecting through tunnel

2021-03-24 20:55

I have been having this issue for quite few months now. I started with winscp script, moved to winscp .net assembly, hoping to find a solution, but didnt help.
My scenario:
I post files to client sftp location from my server tunneling thru proxy. I have 2 environments, both tunnel thru the same proxy to post the files on client location. Both environments have 2 different logins and their own host keys. 30% of the times, the upload fail saying -

(Exception) **Host key does not match configured key fingerprint "ssh-rsa 2048 xxxxxxxxxxxxxxxxxxxxxx="!**

Here is the code:

SessionOptions sessionOptions = new SessionOptions
{
    Protocol = Protocol.Sftp,
    HostName = ConfigurationManager.AppSettings["ClientHostName"],
    UserName = ConfigurationManager.AppSettings["ClientUserName"],
    Password = ConfigurationManager.AppSettings["ClientPassword"],
    SshHostKeyFingerprint = ConfigurationManager.AppSettings["ClientHostKey"],
    PortNumber = Convert.ToInt32(ConfigurationManager.AppSettings["ClientPort"])                    
};
 
if (tunneling)
{
    sessionOptions.AddRawSettings("Tunnel", "1");
    sessionOptions.AddRawSettings("TunnelHostName", ConfigurationManager.AppSettings["ProxyHostName"]);
    sessionOptions.AddRawSettings("TunnelPortNumber", ConfigurationManager.AppSettings["ProxyPort"]);
    sessionOptions.AddRawSettings("TunnelUserName", ConfigurationManager.AppSettings["ProxyUserName"]);
    sessionOptions.AddRawSettings("TunnelPublicKeyFile", ConfigurationManager.AppSettings["ProxyPrivateKeyPath"]);
    sessionOptions.AddRawSettings("TunnelHostKey", ConfigurationManager.AppSettings["ProxyHostKey"]);
}

Logs attached:
This exception does not occur all the time. But only some instances and could not figure out when and why. Any insights/ideas much appreciated. Please help!!

sftpLog.log (8.43 KB, Private file)

Reply with quote

martin◆ Site Admin
Joined:: 2002-12-10
Posts:: 41,405
Location:: Prague, Czechia

Re: Winscp Sporadically fails on Host key does not match

2021-03-26

Isn't your server load balanced?
Can you post a log of a successful connection?

Reply with quote

DotnetDeveloper
Joined:: 2021-03-24
Posts:: 6
Location:: Virginia

2021-03-26 15:07

Thank you, Martin for your reply.
No, our server does not have load balancer.
Attaching successful attempt logs

SuccessSftpLog.log (12.86 KB, Private file)

Reply with quote

martin◆ Site Admin
Joined:: 2002-12-10
Posts:: 41,405
Location:: Prague, Czechia

Re: Winscp Sporadically fails on Host key does not match

2021-03-29

Aren't you running multiple transfers in parallel?

WinSCP picks a free local port for the port forwarding, but before it is able to establish the tunnel, something steals the port. That's something that should be improved definitely. I'll look at this.

But meanwhile, you can try to make you own choice using TunnelLocalPortNumber raw session settings:
https://winscp.net/eng/docs/rawsettings#tunnellocalportnumber

Reply with quote

martin◆ Site Admin

Re: Winscp Sporadically fails on Host key does not match

2021-03-29

I forgot to mention how it relates to the host key. It actually seems that the session connects to a tunnel opened at the same by another connection. So it connects to a wrong host. That's why the host key does not match.

Reply with quote

martin◆ Site Admin

Re: Winscp Sporadically fails on Host key does not match

2021-03-30

WinSCP will now report a meaningful error:
https://winscp.net/tracker/1970
Fix to prevent this from happening in the first place is still pending.

Reply with quote

DotnetDeveloper

2021-03-30 16:26

Thank you so much for the temporary fix version to report a meaningful error, Martin.
Can you please give me the direct link to the version to download? I could not find it.
Any estimate at this time for a permanent fix?

Reply with quote

martin◆ Site Admin
Joined:: 2002-12-10
Posts:: 41,405
Location:: Prague, Czechia

2021-04-06

Permanent fix is done:
https://winscp.net/tracker/1971

I'm sending you an email with a development version of WinSCP to the address you have used to register on this forum.

Reply with quote

DotnetDeveloper

2021-05-10 19:11

Thank you so very much for being prompt and on top of things, Martin. Truly appreciate your help. Let me download the fixed version and try it out.
Thanks much again.

Reply with quote

DotnetDeveloper
Joined:: 2021-03-24
Posts:: 6
Location:: Virginia

2021-05-13 16:21

Hi Martin,
I was hoping this bugfix will handle multiple sftp tunnel requests at the same time to the same port. But my job failed today again!! Only with a different errror message :(

2021-05-13 11:00:35.2342|Info|Exception encountered during sftp transfer: Error while tunneling the connection.
Local port 10022 forwarding to ast.carefirst.com:22 failed: Network error: Address already in use

I have 2 different processes trying at the same time delivering the files to 2 different client locations thru the same tunnel port.
How do I address this?

Reply with quote

martin◆ Site Admin

2021-05-14

Ok, you probably still use the workaround with the explicit local port set using TunnelLocalPortNumber, what bypasses the fix and actually cause the problem, if you use the same port for both your processes. Remove that. Or even better set a unique port for each parallel process.

Reply with quote

DotnetDeveloper
Joined:: 2021-03-24
Posts:: 6
Location:: Virginia

2021-05-17 16:37

Martin,
I only have one port available from my network team. So can you please explain how to make your fix work. What exactly was fixed in this version?

sessionOptions.AddRawSettings("Tunnel", "1");
sessionOptions.AddRawSettings("TunnelHostName", ConfigurationManager.AppSettings["ProxyHostName"]);
sessionOptions.AddRawSettings("TunnelPortNumber", ConfigurationManager.AppSettings["ProxyPort"]);
sessionOptions.AddRawSettings("TunnelLocalPortNumber", ConfigurationManager.AppSettings["ProxyPort"]);
sessionOptions.AddRawSettings("TunnelUserName", ConfigurationManager.AppSettings["ProxyUserName"]);
sessionOptions.AddRawSettings("TunnelPublicKeyFile", ConfigurationManager.AppSettings["ProxyPrivateKeyPath"]);
sessionOptions.AddRawSettings("TunnelHostKey", ConfigurationManager.AppSettings["ProxyHostKey"]);

This is still my code. What should be taken, and what should be changed?
Please explain.

Reply with quote

martin◆ Site Admin

2021-05-18

The port is used locally only (and within single WinSCP process only). I do not think you need any permission from your network team. It's not network-related.

Reply with quote

WinSCP sporadically fails on Host key does not match when connecting through tunnel