Error to add new destination with SFTP

Hello Nivalys,

Does the agent performing the backup have access to the internet and ports open for this type of backup?

Hello Nivalys,

welcome to Acronis forums!

If this issue still persists, please make sure if the SFTP path is accessible from the Agent that is selected in UI for browsing to this backup location. Alternately, please change the machine to browse from.

Please also make sure the firewall is not blocking any ports that are required for communications

Firewall settings for Acronis products: https://kb.acronis.com/content/1711

Check if the below condition applies to the SFTP in use:

SFTP
Type the SFTP server name or address. The following notations are supported:

sftp://<server>
sftp://<server>/<folder>

After entering the user name and password, you can browse the server folders.

In either notation, you can also specify the port, user name, and password:

sftp://<server>:<port>/<folder>
sftp://<user name>@<server>:<port>/<folder> sftp://<user name>:<password>@<server>:<port>/<folder>

If the port number is not specified, port 22 is used.

Users, for whom SFTP access with no password is configured, cannot back up to SFTP.

Hi there!

I do have the same issue: I want to store backups to my Synology-NAS using an SFTP-connection.
I tried to connect through SFTP with FileZilla from the same server to my NAS. With FileZilla, there aren't any connection issues.

But I'ts somehow not possible to even establish a SFTP-connection with Acronis Backup 12.5 (newest version):

Hello Mathias,

welcome to Acronis forums!

Thank you for sharing an activity log. I have found that a similar error log reflects issues on the SFTP server side.
You will need to adjust the SSL security settings and use the same credentials again to access this backup location from the Agent machine.

Hi there

Thanks, but this is a tutorial on how to install & deploy a self-signed certificate for the local computer/server with an Acronis installation.

I also tried to import the SFTP-server-certificate through group policies but that doesn't helps eighter.
And as I already said: The connection to the SFTP-server with FileZilla is working. So I think this issue is definitely linked to Acronis.
And which SFTP Settings should I adjust?

Hello Mathias.

I recommend that you check if this issue is on Acronis side the following way: please change the backup format to Version 11 and re-attempt to create this backup to the same SFTP NAS location. 

If the error does not reproduce, then the cause of this issue is incorrectly working network connection retries on SFTP with Version 12 backup format. Then please open a case with Acronis Support Team and provide engineers with Acronis System Information gathered from the Agent machine and SFTP logs for analysis.

Hello Maria

This error doesn't happen while trying to make a backup. It happens already while trying to add a new backup location:
"Backup" --> "Add location" and also while trying to modify an existing backup an adding the new backup location there. It hasn't something to do with the backup-process itself.

But as et seems that there isn't a soultion for this error, I think I'll have to open a case with Acronis Support Team...

Hello Mathias.

Thanks for the clarification. Then it does not look like a problem with retries in Version 12 in Acronis Cyber Backup 12.5.

In any case, contacting Acronis Support Team will help to sort it out. Please collect PCAP logs and specify the source and target IPs for analysis purposes when providing them to Acronis engineers.

OK, after e-mailing over days with the support, they found the issue:
 

The server responds that it supports key exchange algorithms: 

"curve25519-sha256@libssh.org", "diffie-hellman-group-exchange-sha256"
while the product supports only "diffie-hellman-group1-sha1", "diffie-hellman-group14-sha1", which are listed as 'MUST' https://tools.ietf.org/html/rfc4253#page-23

You should enable one of them on the SFTP server.

NAS is running some Linux version, and those algorithms are implemented in ssh daemon
but disabled in newer versions as being not-so-secure.
If you can login to the device as admin and somehow access configuration files,
it should be as easy as uncommenting some line or adding a one in a configuration file.

In other words, Acronis is using SHA1 as key exchange algorithms. SHA1 is over 25 years old and - as the supporter said - not that secure. Thus, lot of linux distributions disabled this key exchange algorithm by default and I really don't know why Acronis is still using SHA1 in their software products - I hope there is an update soon!

But till then, there is a temporary solution:

On your Synology-NAS, go to Control Panel -> Terminal & SNMP -> Advanced Settings -> Customize and activate under KEX the option diffie-hellman-group14-sha1

Now you should be able to establish a sftp-connection with acronis to your Synology-NAS :)

Hello Mathias.

Thank you for posting the output and sharing a workaround with other forum users! We also thank you for the cooperation in revealing this issue (TTASK-32924).

Hello there,

I also have this problem with the same errors. However, my SFTP server does not allow SHA1, even if I try to activate it. Is there an update planned for Acronis Cyber Backup in the foreseeable future that supports current methods?

Hello Nils,

thank you for posting on Acronis forums!

Could you please share an activity log with this error?