https://bugs.kde.org/show_bug.cgi?id=526893
Bug ID: 526893
Summary: sftp worker offers all ssh-agent keys and retries
silently, triggering server-side fail2ban bans; no
diagnostics in Dolphin
Classification: Frameworks and Libraries
Product: kio-extras
Version First 26.08.1
Reported In:
Platform: Fedora RPMs
OS: Linux
Status: REPORTED
Severity: normal
Priority: NOR
Component: SFTP
Assignee: [email protected]
Reporter: [email protected]
Target Milestone: ---
Setup:
ssh-agent provided by KeePassXC, holding several keys (more than the server’s
MaxAuthTries)
Two accounts on the same SFTP server (non-standard port 2121): one key-based,
one password-based
Password for the second account stored in KWallet by KIO
Steps to reproduce:
Load more than ~5 keys into ssh-agent
In Dolphin, open sftp://user@host:2121/ for an account that uses password
authentication
Dolphin appears to hang; no error or progress is shown
Retry a few times
Actual result:
The sftp worker offers every key from the agent before falling back to password
authentication. With many keys this hits MaxAuthTries (“Too many authentication
failures”) before the password is ever tried.
Dolphin shows no error message, the view just hangs.
After a few attempts the server’s fail2ban blocks the client IP. Subsequent
connections time out at TCP level (debug log below), which also breaks the
previously working key-based account.
Expected result:
A way to restrict which identities the sftp worker offers. OpenSSH supports
IdentitiesOnly yes in ~/.ssh/config; as far as I can tell this is not honored
by the sftp worker (PubkeyAuthentication no is).
An error message in Dolphin when authentication fails or the connection times
out, instead of an apparently frozen view.
No silent automatic reconnection after authentication failures, since each
attempt counts against server-side rate limits.
Suspected contributing factor (not verified): Dolphin may open several parallel
worker connections (listing, previews, information panel), multiplying the
failed attempts per user action.
Workaround: a ~/.ssh/config host alias with PubkeyAuthentication no for the
password account, then sftp://alias/.
Debug log (QT_LOGGING_RULES="kf.kio.workers.sftp.debug=true"
KIO_SFTP_LOG_VERBOSITY=4 kioclient ls sftp://…), captured after the ban:
ssh_connect_host_nonblocking: Connecting to host palladius.sui-inter.net
[80.74.142.110] port 2121
ssh_connect_host_nonblocking: EINPROGRESS => Store for later.
ssh_connect: Actual timeout : 30000
ssh_connect: Timeout connecting to palladius.sui-inter.net
kioclient: Timeout connecting to palladius.sui-inter.net
--
You are receiving this mail because:
You are watching all bug changes.
