SSH.NET timeout when connecting to AWS Managed SFTP server in C#

user_585067 0
Viewed 5113

I'm having issues trying to establish a connection to an AWS Managed SFTP server. Using the credentials I have on hand, I'm able to connect to the server from my Windows command line using the sftp command. Here's my .NET code:

using (var client = new SshClient(new ConnectionInfo(baseHost, user,
            new AuthenticationMethod[]{
                new PrivateKeyAuthenticationMethod(user,new PrivateKeyFile[]{
                    new PrivateKeyFile(keyLocation, pkpassword)
                }),
            }
        )))
{
    client.Connect(); // Timeout here
}

The code above gets to the client.Connect() line, then times out after 30 seconds with a Renci.SshNet.Common.SshOperationTimeoutException exception. When I look at what's happening with Wireshark, I see that the protocol being used by the sftp command line utility is SSH, while the SSH.NET is using TCP, and the packet sizes are completely different.

Does anybody know what I might be missing here?

I'm running the sftp command-line utility on the same computer as the above code. The first Wireshark image below is from the C# code above. The second is from the sFTP utility:

Wireshark Capture from C# Code

Wireshark Capture from sFTP utility

When I attempt to connect to the server's port 22 using PuTTY in raw mode, I get no response.

Thanks, Jim

ssh.net amazon-web-services sftp ssh c#
1 Answers

This is bug both in old versions of SSH.NET and on Amazon Managed SFTP server side.

According to RFC 4253 Section 4.2. Protocol Version Exchange:

When the connection has been established, both sides MUST send an identification string.

Both SSH.NET client and Amazon Managed SFTP server fail this requirement. Both first wait for the other side to send the identification string before sending its own. A deadlock is inevitable (interrupted only by a timeout). That also explains why Wireshark does not identify the session as SSH, as there's no data exchanged at all. Hence, there's nothing by which the protocol can be identified.

If you can modify SSH.NET source code, moving this line in Session.Connect:

SocketAbstraction.Send(_socket, Encoding.UTF8.GetBytes(string.Format(CultureInfo.InvariantCulture, "{0}\x0D\x0A", ClientVersion)));

... above this block:

Match versionMatch;

//  Get server version from the server,
//  ignore text lines which are sent before if any
while (true)
{
    ...
}

... should fix the problem.

Also consider reporting the bug to Amazon.

I have reported the bug to SSH.NET including the needed change. The fix is included from SSH.NET 2020.0.0 up.

If you cannot change SSH.NET code, you will need to use another SFTP library.

For example my WinSCP .NET assembly is compatible with Amazon Managed SFTP server.

This is an equivalent of your code:

// Set up session options
SessionOptions sessionOptions = new SessionOptions
{
    Protocol = Protocol.Sftp,
    HostName = baseHost,
    UserName = user,
    SshHostKeyFingerprint = ...,
    SshPrivateKeyPath = keyLocation,
    PrivateKeyPassphrase = pkpassword,
};

using (Session session = new Session())
{
    // Connect
    session.Open(sessionOptions);

    // Your code
}

WinSCP GUI can generate a code template like the one above for you.

user_8508480
Related