Cyberduck Mountain Duck CLI

#8173 closed defect (fixed)

Wrong host key fingerprint (and not written to ~/.ssh/known_hosts either)

Reported by: Codifier Owned by: dkocher
Priority: high Milestone: 4.5.2
Component: sftp Version: 4.5
Severity: major Keywords: host key fingerprint
Cc: Architecture: Intel
Platform: Mac OS X 10.6

Description (last modified by dkocher)

When I try to sftp with Cyberduck 4.5.0 - 4.5.2 (haven't tried any older versions) to an Xubuntu 14.04 box using public key authentication, Cyberduck issues the wrong host key fingerprint.

Issuing

for file in /etc/ssh/*sa_key.pub; do ssh-keygen -lf $file; done

on the command line on the Ubuntu server currently yields:

1024 b4:71:14:db:a2:3c:b2:77:ab:b2:1c:4d:56:5b:ad:e4 (DSA)
256 f0:2a:ce:00:bf:cc:fe:15:51:32:42:42:7d:f8:08:be (ECDSA)
2048 63:bd:65:67:f2:77:31:45:ad:00:24:eb:b8:ed:de:d9 (RSA)

Verifying that the file ~/.ssh/known_hosts on my Mac is empty, and connecting to this Ubuntu server, Cyberduck currently yields the following message (roughly translated from Dutch):

Unknown host key for [ip-address]:port
The system does not recognise this host. The host key-fingerprint is 58:83:70:ba:84:04:66:c7:5c:f6:82:1d:6f:51:79:f1.

As you can see, the fingerprint does not match any of the earlier mentioned host key fingerprints.

Eventhough I'm not a professional system administrator and therefore not entirely sure Cyberduck is the culprit, I've tried to verify that Cyberduck is indeed the one issuing the wrong fingerprint, instead of the Ubuntu server itself, by connecting to the Ubuntu server with cli sftp in terminal from the same Mac. This yields the correct unknown host fingerprint.

Furthermore, I've deleted all keys in /etc/ssh/ on the Ubuntu server and reconfigured openssh-server, in an earlier test, as well, with:

sudo dpkg-reconfigure openssh-server

then connected with Cyberduck again to verify that Cyberduck issues a new unknown host fingerprint (which also didn't match any of the actual fingerprints).

I've viewed system.log in Console.app also, just now, and see the possible issue (as these log entries do mention the correct ECDSA fingerprint) in these log messages (hostnames, ip addresses and port redacted):

  Aug 13 07:55:39 Mac [0x0-0x21021].ch.sudo.cyberduck[341]: net.schmizz.sshj.transport.TransportException: [HOST_KEY_NOT_VERIFIABLE] Could not verify `ecdsa-sha2-nistp256` host key with fingerprint `f0:2a:ce:00:bf:cc:fe:15:51:32:42:42:7d:f8:08:be` for `[ip-address]` on port [port][[BR]]Aug 13 07:55:39 Mac Cyberduck[341]: [reader] ERROR net.schmizz.sshj.transport.TransportImpl - Dying because - {}\n\nnet.schmizz.sshj.transport.TransportException: [HOST_KEY_NOT_VERIFIABLE] Could not verify `ecdsa-sha2-nistp256` host key with fingerprint `f0:2a:ce:00:bf:cc:fe:15:51:32:42:42:7d:f8:08:be` for `[ip-address]` on port [port]\n	at net.schmizz.sshj.transport.KeyExchanger.verifyHost(KeyExchanger.java:206)\n	at net.schmizz.sshj.transport.KeyExchanger.handle(KeyExchanger.java:353)\n	at net.schmizz.sshj.transport.TransportImpl.handle(TransportImpl.java:458)\n	at net.schmizz.sshj.transport.Decoder.decode(Decoder.java:107)\n	at net.schmizz.sshj.transport.Decoder.received(Decoder.java:175)\n	at net.schmizz.sshj.transport.Reader.run(Reader.java:61)

So, with my limited understanding, it appears Cyberduck is receiving the correct fingerprint, but can't verify it yet subsequently still issues an unknown host message (with the wrong fingerprint).

Lastly, on accepting this (wrong) unknown host fingerprint, the host is not added to my ~/.ssh/known_hosts file either and Cyberduck therefore repeatedly issues the same unknown host message.

Change History (8)

comment:1 Changed on Aug 13, 2014 at 7:45:09 AM by Codifier

  • Description modified (diff)

comment:2 Changed on Aug 13, 2014 at 7:51:00 AM by Codifier

  • Platform set to Mac OS X 10.6

comment:3 Changed on Aug 13, 2014 at 8:17:38 AM by dkocher

  • Milestone set to 4.5.2
  • Status changed from new to assigned

What a nice bug report!

comment:4 Changed on Aug 13, 2014 at 8:42:13 AM by Codifier

You're welcome, dkocher!

Wonderful program, this Cyberduck. Although it's a little unorthodox for not having an integrated local browser, it's very rich in its capabilities and completely blows Filezilla out of the water, in terms of usability, imho.

I hope you'll be able to fix this. Good luck!

comment:5 Changed on Aug 13, 2014 at 8:42:41 AM by dkocher

  • Resolution set to fixed
  • Status changed from assigned to closed

Test and fix in r14986.

comment:6 Changed on Aug 13, 2014 at 8:43:19 AM by dkocher

This bug was introduced in r14566.

comment:7 Changed on Aug 14, 2014 at 12:29:23 PM by dkocher

#8175 closed as duplicate.

comment:8 Changed on Jul 22, 2019 at 10:53:29 AM by dkocher

  • Description modified (diff)
Note: See TracTickets for help on using tickets.
swiss made software