topic ACS 5.2 fails to send files to sftp server after installing patc in Network Access Control

ACS 5.2 fails to send files to sftp server after installing patch 5

ROBERTO GIANA — Mon, 11 Mar 2019 01:14:39 GMT

After we have installed patch 5 on several ACS 5.2 server they aren't able anymore to write their backups to the sftp servers. I tried to search on the bug tool kit, but it seems to be broken when searching for the keyword "sftp". It's the same when I try to do a "copy logs" with sftp as destination.

running a debug I can see:

acs/admin# copy logs sftp://10.1.115.11/

Collecting logs...

Username: backupuser

Password:

6 [16376]: transfer: cars_xfer.c[301] [admin]: sftp copy out of /var/tmp/ADElogs.tar.gz requested

6 [16376]: transfer: cars_xfer_util.c[412] [admin]: resolved server to 10.1.115.11

7 [16383]: transfer: sftp_copy.c[75] [daemon]: Executing SFTP command: /usr/bin/scp -o StrictHostKeyChecking=no /var/tmp/ADElogs.tar.gz backupuser@10.1.115.11://ADElogs.tar.gz

% Error: Transfer failed

3 [16376]: transfer: sftp_copy.c[230] [admin]: sftp_copy ERROR: command execution failed

3 [16376]: copy: cm_copy.c[1226] [admin]: Logs archive transfer to url sftp://10.1.115.11/ failed retcode=-306

acs/admin#

Is anybody else seeing this problem?

ACS 5.2 fails to send files to sftp server after installing patc

Jatin Katyal — Fri, 22 Jul 2011 17:23:17 GMT

Please get the following debugs from the ACS CLI

debug copy 7

debug transfer 7

Regards,

Jatin

ACS 5.2 fails to send files to sftp server after installing patc

ROBERTO GIANA — Mon, 25 Jul 2011 07:26:44 GMT

It's almost the same as with the copy command:

acs/admin# acs backup acs repository WUG-Test

6 [13229]: transfer: cars_xfer.c[120] [admin]: sftp copy out of /opt/backup/backup-acs-110725-0920-1311578444/acs-110725-0920.tar.gpg requested

6 [13229]: transfer: cars_xfer_util.c[343] [admin]: resolved server to 10.1.115.11

7 [13229]: transfer: cars_xfer_util.c[359] [admin]: copying file to remote server: 10.1.115.11 with full path /acs-110725-0920.tar.gpg

7 [13350]: transfer: sftp_copy.c[75] [daemon]: Executing SFTP command: /usr/bin/scp -o StrictHostKeyChecking=no /opt/backup/backup-acs-110725-0920-1311578444/acs-110725-0920.tar.gpg backupuser@10.1.115.11:/acs-110725-0920.tar.gpg

3 [13229]: transfer: sftp_copy.c[230] [admin]: sftp_copy ERROR: command execution failed

% Error: Failed to perform ACS backup: SSH connect error

acs/admin#

acs/admin# ssh 10.1.115.11 ********

********@10.1.115.11's password:

C:\Windows\system32>

C:\Windows\system32> exit

acs/admin#

BTW: Doing an SFTP with other tools to the same server works. Even with a Cisco Call Manager.

ACS 5.2 fails to send files to sftp server after installing patc

Jatin Katyal — Mon, 25 Jul 2011 09:57:33 GMT

Please confirm if we have the same DH diffie-hellman-group14 on the server side.
Make sure we have SSHv2 configured on the server.

Regards,
Jatin

ACS 5.2 fails to send files to sftp server after installing patc

ROBERTO GIANA — Mon, 25 Jul 2011 11:43:43 GMT

Yes, we have. Please see the logs from a Putty connection:

2011-07-25 13:38:30 Server version: SSH-2.0-WeOnlyDo 2.1.3

2011-07-25 13:38:30 We claim version: SSH-2.0-PuTTY_Release_0.60

2011-07-25 13:38:30 Using SSH protocol version 2

2011-07-25 13:38:30 Using Diffie-Hellman with standard group "group14"

2011-07-25 13:38:30 Doing Diffie-Hellman key exchange with hash SHA-1

2011-07-25 13:38:31 Host key fingerprint is:

BTW: It worked before upgrading from patch 4 to patch 5!

ACS 5.2 fails to send files to sftp server after installing patc

sanjayb — Fri, 05 Aug 2011 19:50:07 GMT

We have run into the same issue whith SFTP. The issue is if the backup transfer takes more than 60 seconds the connection will drop. I have timed my backup transfer many times and it disconnects exactly in 60 seconds. My servers ( ACS and SFTP) are on the same network so there is no latency issues. I have tried will all flavors of the patch levels and the situations is the same . We have been told it will be fixed only in 5.3. which may be some time in october

ACS 5.2 fails to send files to sftp server after installing patc

Michael Famin — Wed, 21 Sep 2011 16:25:09 GMT

Hi,

Just installet a couple of new ACS 5.2 and have exactly the same problem.

Anyone got it to work yet?

Waiting for 5.3 is not an option since we go live with a lot of 802.1x config, and I do not want to live without backups...

ACS 5.2 fails to send files to sftp server after installing patc

ROBERTO GIANA — Wed, 21 Sep 2011 16:53:41 GMT

After installing patch 6 I was able to see in the debugs, that the systems own ssh process isn't able to access its "known_hosts" file. Obviously a bug of the patches. But as we do not have access to the Linux only TAC is able to fix it.

See the threat "ACS can't access ssh known_hosts file".

ACS 5.2 fails to send files to sftp server after installing patc

Michael Famin — Thu, 22 Sep 2011 16:44:53 GMT

Hmmm,

After examining the debug I realized that it is'nt SFTP, it is actually SCP that is used for the file transfer. So I asked our UNIX guys (which were providing the backup server) for an SCP server instead of SFTP. And I was the able to get a manual copy to work!!! The file was an backup to the localfilesystem done earlier.

CLI Initiated Copy
====================

ACS/admin# copy disk:Manual-110921-1832.tar.gpg sftp://10.X.X.X/home/XXXXXX/drop
Username: XXXXXX

Password:
6 [31774]: transfer: cars_xfer.c[301] [admin]: sftp copy out of /localdisk/Manual-110921-1832.tar.gpg requested
6 [31774]: transfer: cars_xfer_util.c[412] [admin]: resolved server to 10.X.X.X

7 [31781]: transfer: sftp_copy.c[75] [daemon]: Executing SFTP command: /usr/bin/scp -o StrictHostKeyChecking=no /localdisk/Manual-110921-1832.tar.gpg XXXXXX@10.107.199.36:/home/XXXXXX/drop//Manual-110921-1832.tar.gpg
7 [31774]: transfer: cars_xfer_util.c[433] [admin]: sftp xfer succeeded

I will however not work with the backup script

CLI Initiated Backup
====================

ACS/admin# acs backup test repository Westlife
6 [32125]: transfer: cars_xfer.c[120] [admin]: sftp copy out of /opt/backup/backup-test-110922-1733-1316705616/test-110922-1733.tar.gpg requested
6 [32125]: transfer: cars_xfer_util.c[343] [admin]: resolved server to 10.X.X.X.X

7 [32125]: transfer: cars_xfer_util.c[359] [admin]: copying file to remote server: 10.X.X.X with full path /home/XXXXXX/drop/test-110922-1733.tar.gpg
7 [32247]: transfer: sftp_copy.c[75] [daemon]: Executing SFTP command: /usr/bin/scp -o StrictHostKeyChecking=no /opt/backup/backup-test-110922-1733-1316705616/test-110922-1733.tar.gpg komscp@10.107.199.36:/home/XXXXXX/drop/test-110922-1733.tar.gpg
3 [32125]: transfer: sftp_copy.c[137] [admin]: sftp_copy ERROR: timeout!
3 [32125]: transfer: sftp_copy.c[230] [admin]: sftp_copy ERROR: command execution failed
% Error: Failed to perform ACS backup: SSH connect error

Can not really see the difference between the scp commands, except the path of the sourcefile.

I realize that I do not have the latest patches installed in my ACS, so I will upgrade a testserver to patchlevel 6 tomorrow and see whats happening. Anyway, the retcode=-306 seems to be because of that my backup server did not accept SCP, only SFTP connections...

ACS 5.2 fails to send files to sftp server after installing patc

ROBERTO GIANA — Fri, 23 Sep 2011 05:13:39 GMT

Please do not confuse the command "scp" with the protocol "scp". 😉 Using the command scp you can decide which transfer method you would like to use. Usually you can use "scp" or "sftp" as transfer method.

For example for PuTTy you can control it by using "pscp -scp ..." or "pscp -sftp ..."

ACS 5.2 fails to send files to sftp server after installing patc

Michael Famin — Fri, 23 Sep 2011 09:13:52 GMT

OK, Sorry for that.

What I ment to point out was that the ACS is using the SCP protocol.

From the Releasenote:(http://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_system/5.2/release/notes/acs_52_rn.html#wp190802)

SFTP Copy

In ACS 5.2, SSH File Transfer Protocol (SFTP) is implemented by Secure Copy Protocol (SCP).

And our backupserver has different accounts if you are using the sftp or scp protocol. If I use the sftp account the transfer fails with retcote=-306, but if I use the scp account it works.

ACS 5.2 fails to send files to sftp server after installing patc

sanjayb — Fri, 23 Sep 2011 13:17:17 GMT

This is a known bug. The SFTP File transfer will fail if the time it takes to backup is more than a minute. I have tested it many times and has been verified by cisco, the fix will only be done in 5.3

ACS 5.2 fails to send files to sftp server after installing patc

Michael Famin — Fri, 23 Sep 2011 15:30:31 GMT

Hmm,

Thats the BugID: CSCtn78315 you mention.

It seems strange to me though, because if I backup to localdisk and then manually copy the file with the command:

copy disk:Manual-110923-1723.tar.gpg sftp://10.X.X.X/home/XXXXXX/drop

It takes less than 5 seconds to copy it successfully...

Might open a TAC Case on this.

ACS 5.2 fails to send files to sftp server after installing patc

Michael Famin — Mon, 10 Oct 2011 16:08:10 GMT

Hi again,

Opened a TAC case on this, and the TAC identified it as the 60 seconds bug (CSCtn78315), and told me it was fixed in

release 5.3. So, I downloaded and upgraded on my test ACS server.

Unfortionally it did'nt do any good. The behavior is still the same.

We'll see what the TAC says...

ACS 5.2 fails to send files to sftp server after installing patc

Michael Famin — Fri, 04 Nov 2011 09:18:13 GMT

Hi,

My problem was that I had an too long password. The password can not be longer than 16 characters.

To new BugID created from the TAC Case: CSCtt47076 and CSCtt46924

ACS 5.2 fails to send files to sftp server after installing patc

alicato43 — Wed, 04 Jan 2012 23:02:05 GMT

hi all,

upgrade to 5-3-0-40-1, and still having backup issues,

error message,

% Creating backup with timestamped filename: acs2-120105-0956.tar.gpg

% ERROR : Backup failed due to one of the following reasons

1. host-key option is not configured

2. host key is removed because of re-image

3. host key is removed from some other repository having same ip/hostname

% Please reconfigure the host-key option

% SSH connect error

% Creating backup with timestamped filename: acs2-120105-0956.tar.gpg
% ERROR : Backup failed due to one of the following reasons
1. host-key option is not configured
2. host key is removed because of re-image
3. host key is removed from some other repository having same ip/hostname
% Please reconfigure the host-key option
% SSH connect error

no info in google please advise

thanks

ACS 5.2 fails to send files to sftp server after installing patc

camejia — Wed, 04 Jan 2012 23:43:52 GMT

Hello,

I am assuming that you upgraded your ACS to 5.3 Patch 1 based on the known issue:

CSCtn78315

Backing up data failed while using SFTP if it was not transferred within 60 seconds. This problem is resolved now.

However, we might run into the same issue if the server you are copying the backup does not support SCP.

If you execute the "show repository " do you get the listing output of the files that exist on server? If yes we need to verify that the SFTP server supports SCP as well.

If the "show repository " successfully retrieves the files listing but you are not able to backup your ACS configuration to the same server a possible reason is that the SFTP server does not support or does not have SCP enabled on it.

ACS 5.x uses SFTP to "READ" the server folder but uses SCP to "copy/write" files to it.

Hope this helps.

Regards.

ACS 5.2 fails to send files to sftp server after installing patc

alicato43 — Wed, 04 Jan 2012 23:49:54 GMT

ssh to host via console and all working

thanks

ACS 5.2 fails to send files to sftp server after installing patc

sanjayk_gupta — Thu, 06 Sep 2012 07:15:33 GMT

pls check...if it can help to get the sollution...

ACS5.2/admin# copy logs disk:/ACS5.2

Collecting logs...
6 [22514]: transfer: cars_xfer.c[293] [admin]: local copy out of /var/tmp/ADElogs.tar.gz requested
7 [22514]: transfer: cars_xfer_util.c[959] [admin]: copying /var/tmp/ADElogs.tar.gz to /localdisk/ACS5.2

ACS5.2/admin# copy logs sftp://10.13.1.30
Collecting logs...
Username: username

Password:
6 [22523]: transfer: cars_xfer.c[301] [admin]: sftp copy out of /var/tmp/ADElogs.tar.gz requested
6 [22523]: transfer: cars_xfer_util.c[412] [admin]: resolved server to 10.x.x.x

7 [22532]: transfer: sftp_copy.c[75] [daemon]: Executing SFTP command: /usr/bin/scp -o StrictHostKeyChecking=no /var/tmp/ADElogs.tar.gz User@10.x.x.x://ADElogs.tar.gz
3 [22523]: transfer: sftp_copy.c[230] [admin]: sftp_copy ERROR: command execution failed
% Error: Transfer failed
3 [22523]: copy: cm_copy.c[1226] [admin]: Logs archive transfer to url sftp://10.x.x.x failed retcode=-306
ACS5.2/admin# ssh 10.x.x.x username
User@10.x.x.x's password:
Last login: Thu Sep 6 12:24:40 2012 from ACS5.2

User@Bcld170bm2 ~
$ /usr/bin/scp -o StrictHostKeyChecking=no /var/tmp/ADElogs.tar.gz User@10.x.x.x:/10.x.x.x
User@10.x.x.x's password:
ADElogs.tar.gz 100% 0 0.0KB/s 00:00

User@SFTPServer ~

ACS 5.2 fails to send files to sftp server after installing patc

sanjayk_gupta — Thu, 06 Sep 2012 09:37:53 GMT

Problem is still same. even manualy, I am not able to send the backup file to the sftp server.

ACS5.2/admin# copy disk:running-config sftp://x.x.x.x/
Username: username

Password:
6 [28826]: transfer: cars_xfer.c[301] [admin]: sftp copy out of /localdisk/running-config requested
6 [28826]: transfer: cars_xfer_util.c[412] [admin]: resolved server to 10.x.x.x

7 [28832]: transfer: sftp_copy.c[75] [daemon]: Executing SFTP command: /usr/bin/scp -o StrictHostKeyChecking=no /localdisk/running-config User@10.x.x.x://running-config
% Error: Transfer failed
3 [28826]: transfer: sftp_copy.c[230] [admin]: sftp_copy ERROR: command execution failed
ACS5.2/admin# 3 [28826]: copy: cm_copy.c[640] [admin]: localfile disk:running-config transfer to url sftp://10.x.x.x/ failed retcode=-306