Getting backrest working with sftp/hetzner storage box

[cbarratt]

I'm hoping some one out there in the community has this working but I feel like I must be missing something obvious:

• I'm mounting the pubkey into the docker container
• Passing the sftp args to restic and specifying said key

I seem to just be permanently stuck on the same error whatever configuration I try

Operation failed: [unknown] failed to init repo: init failed: command "/bin/restic-0.16.4 init --json -o sftp.args=-i /data/id_rsa.pub" failed: exit status 1 Process STDOUT: subprocess ssh: Host key verification failed. Fatal: create repository at sftp://<user>@<user>.your-storagebox.de:/repo failed: unable to start the sftp session, error: error receiving version packet from server: server unexpectedly closed connection: unexpected EOF

[MadJalapeno]

Don't know if you're still trying this, but don't they use port 23 for ssh access?

[cbarratt]

i've just double checked and storagebox is 22 or 23, that makes sense as my normal restic usage works just fine without specifying port 23

[madmalkav]

[madmalkav]

I think it may be something like this

https://www.reddit.com/r/linuxquestions/comments/16qcnzz/ssh_does_not_work_in_python_subprocess_as_a/

because ssh works ok from the shell of the docker and only throws Permission denied (publickey,password) when launched from backrest

[garethgeorge]

In general, backrest's logging for SFTP support is not the best; improving this or writing a wiki guide is on my todo list (or somewhere I'd welcome contribution) but not something I've gotten to yet.

General advice is to setup by first docker exec -it <your container> bash to get a shell in the backrest container, and then crafting an ssh command on that bash shell that works to connect to your target machine.

Once you have that command, the easiest way to get going may be using sftp.command which takes the complete SSH command that you crafted using docker exec. Note: this means that the host configured in your repo URI does not matter. See this thread on the restic forums for a bit of context.

Your options should then look something like

• URI: sftp::/my-backup-repo-path , note the double colon which skips providing any host name.
• Flags: add a flag for sftp.command e.g. -o sftp.command="<your complete SFTP commmand>" i.e. -o sftp.command="ssh <hostname> -l <username> -i <private key file> -oBatchMode=yes -s sftp"

Note: whether using sftp.args OR sftp.command, I recommend you include -oBatchMode=yes as this will prevent the SSH process from blocking for input when encountering an error (e.g. running into the password prompt on the remote system). This can be very problematic when trying to debug access issues etc as commands will appear to simply hang without completing.

[gurabli]

I just posted this in a different thread, but posting here as well, since I'm also using Hetzner's SB with SFTP.

I'm running the docker version on my home server (linux). From the host I did the SSH key authentication between my home server and the remote server. Tested the connection, works fine.
Then I just added a volume mount to Backrest docker compose to mount the host authorized_keys and works perfectly fine -- note the read only flag (:ro).

volumes:
  - /home/<USER>/.ssh:/root/.ssh:ro

Restart Backrest and there you go with the sftp connection without password with all your hosts that are already enabled with auth keys.