Please let me know if the fix for “crypto/rsa: verification error” is included in the Bug Fixes for Community Docker image v2.6.4.

[dtabata]

The great author, @drakkan, seems to be saying that it will be included in the next stable release.

And v2.6.4 contains Bug Fixes that are of interest.

Here is a issues#1750

ーーーーーーーーーーーーーーーーーーーーーーー

Bug description

We see intermittent instances of users failing SSH negotiation. They don't even get to authentication; the connection fails somewhere in the SSH handshake, and SFTPGo logs a "crypto/rsa: verification error" message. From the client's point of view, the connection drops unexpectedly.

This problem only occurs rarely (<1% of connections for affected users), and doesn't affect all users. I have not been able to identify any common factors among the users that are affected, and there's no sign that the server is hitting connection limits or is experiencing significant load. Users who experience the problem can reconnect successfully the next time they try, but it tends to trip up semi-automated transfers with poor error handling.

Installation method

Community Docker image

SFTPGo version

v2.5.6

Steps to reproduce

1. Wait for users to connect a significant number of times.
2. Search the logs for "crypto/rsa: verification error"

Expected behavior

User is able to negotiate the SSH connection and proceed to authentication.

Configuration

apiVersion: "apps/v1"
kind: "Deployment"
metadata:
  name: "..."
spec:
  ...
  template:
    metadata:
      labels:
        app.kubernetes.io/name: "..."
      annotations:
        gke-gcsfuse/volumes: "true"
    spec:
      ...
      containers:
        - name: "..."
          image: "drakkan/sftpgo:v2.5.6-slim"
          ports:
            ...
          resources:
            ...
          env:
            - name: "SFTPGO_DATA_PROVIDER__CREATE_DEFAULT_ADMIN"
              value: "true"
            - name: "SFTPGO_DEFAULT_ADMIN_USERNAME"
              value: "..."
            - name: "SFTPGO_DATA_PROVIDER__DRIVER"
              value: "postgresql"
            - name: "SFTPGO_DATA_PROVIDER__NAME"
              value: "..."
            - name: "SFTPGO_DATA_PROVIDER__HOST"
              value: "..."
            - name: "SFTPGO_DATA_PROVIDER__PORT"
              value: "5432"
            - name: "SFTPGO_DATA_PROVIDER__USERNAME"
              value: "..."
            - name: "SFTPGO_COMMON_DEFENDER__ENABLED"
              value: "true"
            - name: "SFTPGO_COMMON_DEFENDER__BAN_TIME"
              value: "15"
            - name: "SFTPGO_COMMON_DEFENDER__BAN_TIME_INCREMENT"
              value: "100"
            - name: "SFTPGO_COMMON_DEFENDER__THRESHOLD"
              value: "5"
            - name: "SFTPGO_COMMON_DEFENDER__OBSERVATION_TIME"
              value: "15"
            - name: "GOOGLE_APPLICATION_CREDENTIALS"
              value: "/var/secrets/google/key.json"
            - name: "SFTPGO_HTTPD__BINDINGS__0__CLIENT_IP_PROXY_HEADER"
              value: "X-Forwarded-For"
            - name: SFTPGO_HTTPD__BINDINGS__0__CLIENT_IP_HEADER_DEPTH
              value: "0"
            - name: SFTPGO_HTTPD__BINDINGS__0__PROXY_ALLOWED
              value: "130.211.0.0/22,35.191.0.0/16"
          volumeMounts:
            ...
          readinessProbe:
            ...

Relevant log output

failed to accept an incoming connection from ip "xxx.xxx.xxx.xxx": crypto/rsa: verification error

ーーーーーーーーーーーーーーーーーーーーーーー