SSH.NET timeout when connecting to AWS Managed SFTP server in C#

Question

I'm having issues trying to establish a connection to an AWS Managed SFTP server. Using the credentials I have on hand, I'm able to connect to the server from my Windows command line using the sftp command. Here's my .NET code:

using (var client = new SshClient(new ConnectionInfo(baseHost, user,
            new AuthenticationMethod[]{
                new PrivateKeyAuthenticationMethod(user,new PrivateKeyFile[]{
                    new PrivateKeyFile(keyLocation, pkpassword)
                }),
            }
        )))
{
    client.Connect(); // Timeout here
}

The code above gets to the client.Connect() line, then times out after 30 seconds with a Renci.SshNet.Common.SshOperationTimeoutException exception. When I look at what's happening with Wireshark, I see that the protocol being used by the sftp command line utility is SSH, while the SSH.NET is using TCP, and the packet sizes are completely different.

Does anybody know what I might be missing here?

I'm running the sftp command-line utility on the same computer as the above code. The first Wireshark image below is from the C# code above. The second is from the sFTP utility:

When I attempt to connect to the server's port 22 using PuTTY in raw mode, I get no response.

Thanks, Jim

Answer 1

According to RFC 4253 Section 4.2. Protocol Version Exchange :

When the connection has been established, both sides MUST send an identification string.

Both SSH.NET client and Amazon Managed SFTP server fail this requirement. Both first wait for the other side to send the identification string before sending its own. A deadlock is inevitable (interrupted only by a timeout). That also explains why Wireshark does not identify the session as SSH, as there's no data exchanged at all. Hence, there's nothing by which the protocol can be identified.

If you can modify SSH.NET source code, moving this line in Session.Connect :

SocketAbstraction.Send(_socket, Encoding.UTF8.GetBytes(string.Format(CultureInfo.InvariantCulture, "{0}\x0D\x0A", ClientVersion)));

... above this block:

Match versionMatch;

//  Get server version from the server,
//  ignore text lines which are sent before if any
while (true)
{
    ...
}

... should fix the problem.

Also consider reporting the bug to Amazon.

I have reported the bug to SSH.NET including the needed change .

---

If you cannot change SSH.NET code, you will need to use another SFTP library.

For example my WinSCP .NET assembly is compatible with Amazon Managed SFTP server.

This is an equivalent of your code:

// Set up session options
SessionOptions sessionOptions = new SessionOptions
{
    Protocol = Protocol.Sftp,
    HostName = baseHost,
    UserName = user,
    SshHostKeyFingerprint = ...,
    SshPrivateKeyPath = keyLocation,
    PrivateKeyPassphrase = pkpassword,
};

using (Session session = new Session())
{
    // Connect
    session.Open(sessionOptions);

    // Your code
}

WinSCP GUI can generate a code template like the one above for you.