Hostkey in batch wrong, but why? :: Support Forum

M'o
Joined:: 2024-02-27
Posts:: 2

Hostkey in batch wrong, but why?

2024-02-27 07:44

Hello together,

I am using WinSCP a long time, but on now I have a problem, which I can not explain.

My connection:

sftp://***_inventory_1:ABCDEF123@ftp.***.com

While connection WinSCP displays a warning with

ssh-ed25519 255 qWRVAHViZbYRiTIOB3+yjpMuNbAe/+TMvJuPSDVkedM
ssh-ed25519 255 85:6c:7c:b8:d2:38:6d:70:1d:6d:95:56:4f:76:76:b6

I accepted the host key and it was written to the registry.

With the active connection I copied the session code from the Tabs pane and inserted the lines into my script:

%WinSCP% ^
  /log="%ImportPath%WinSCP_%LName%.log" /ini=nul ^
  /command ^
    "open sftp://***_inventory_1:ABCDEF123@ftp.***.com/ -hostkey=""ssh-ed25519 255 qWRVAHViZbYRiTIOB3+yjpMuNbAe/+TMvJuPSDVkedM"" -rawsettings FSProtocol=2" ^
   "get %ImportFile% %ImportPath%" ^
    "exit"

If I ran the script, the host key is not working:

c:\ImportSkripte\Tools>WinSCP.com   /log="C:\ImportSkripte\BDI_KSTools\WinSCP.log" /ini=nul   /command     "open sftp://***_inventory_1:ABCDEF123@ftp.***.com/ -hostkey=""ssh-ed25519 255 qWRVAHViZbYRiTIOB3+yjpMuNbAe/+TMvJuPSDVkedM"" -rawsettings FSProtocol=2"     "get Inventory_1.csv C:\ImportSkripte\BDI_KSTools\"     "exit"
Gegenstelle wird gesucht …
Verbindung mit Gegenstelle wird hergestellt …
Authentifizierung …
Hostschlüssel passt nicht zum konfigurierten Schlüssel „ssh-ed25519 255 qWRVAHViZbYRiTIOB3+yjpMuNbAe/+TMvJuPSDVkedM“!
Fingerabdruck des Hostschlüssels ist ssh-ed25519 255 t1GezAJ13IFZWHLsONnqoFe3MCfbg4vItoftfDzmg5k.
Anmeldung fehlgeschlagen.

Have anyone an idea to this? WinSCP is the latest version 6.3.1
Thank you!

Kind Regards,
M'o

Reply with quote

M'o

Solved

2024-02-28 08:10

I found a solution: -hostkey=*

Reply with quote

martin◆ Site Admin
Joined:: 2002-12-10
Posts:: 41,441
Location:: Prague, Czechia

Re: Hostkey in batch wrong , but why?

2024-02-29

Either your SFTP server is load balanced and each instance has different host key (in that case you need to list fingerprints of all hostkeys in your script).
Or you didn't actually connect to the same server in GUI.
Or the host key has changed meanwhile.
Or you are under MITM attack.

I any case, the -hostkey=* is a security flaw, not a solution.

If you need further help, we need logs. Both from the script and the GUI.

Reply with quote

Hostkey in batch wrong, but why?