Forum » Support and Bug Reports »

Post a reply

Before posting, please read how to report bug or request support effectively.

Bug reports without an attached log file are usually useless.

Options
Add an Attachment

If you do not want to add an Attachment to your Post, please leave the Fields blank.

(maximum 10 MB; please compress large files; only common media, archive, text and programming file formats are allowed)

Options

Topic review

martin

To show hidden/dot files, enable Show hidden files preference option:
https://winscp.net/eng/docs/ui_pref_panels

Or even easier, there's a counter of hidden files below the file panel. Just click the counter to display the hidden files.
ritjesman

Apologies for the very delayed response; I had monitored for about a week before concluding you’re probably a “one man show”. Anyway I did find the needed fingerprint using the WinSCP client and have successfully tested SFTP.
A small bit of feedback on the client: I’m unable to figure out how to get all of the “.folder” folders to display. This is a show stopper for me since Let’s Encrypt requires creation folders specifically named “hostRoot/.well-known/acme-challenge/” on the host. End result is I’m still relying on FileZilla
I’m curious about FTP being acceptable. My host (Namecheap) states in their documentation that SFTP is preferred and standard FTP is actually turned off for their business accounts?
Thanx for your time and the useful apps (the client and WinSCP for .NET)
martin

For SFTP protocol, the Session.ScanFingerprint cannot return "16:c0:...b8:e5". It should return a string starting the the key type (like "ssh-rsa").

If you got "16:c0:...b8:e5", then it looks like you did call Session.ScanFingerprint with SessionOptions for FTP (actually for secure FTPS) and got TLS certificate fingerprint. You have then manually added unrelated SSH hostkey type prefix "ssh-rsa" and you try to use it for SFTP session. That indeed cannot work.

You have to call Session.ScanFingerprint for the same protocol as for the Session.Open.

Also note that you are using secure FTP, not unencrypted FTP. While most would still consider SFTP better, secure FTP is still ok to use.
ritjesman

Thank you for the response.

I'm creating a WinForms app to automate Let's Encrypt TLS/SSL Cert issuance/renewal. A step is to upload Challenge response files to appropriate folders on my hosted domains which verifies my ownership of the domains. I can do this using FTP but based on what I've read on this site using the unsecured FTP protocol is not advised. Further the hosting provider (namecheap) prefers SFTP, advises against the use of unsecured FTP and disallows FTP on all of their hosting packages except the "basement" package to which I'm currently subscribing. And finally, I've presumed that "more secure" = "better".

As a result I'm trying to understand how to use SFTP but when I change the SessionOptions.Protocol from Ftp to Sftp it throws the
FTP connect error:: System.ArgumentException: SessionOptions.Protocol is Protocol.Sftp or Protocol.Scp, but SessionOptions.SshHostKeyFingerprint is not set.

error which led to SshHostKeyFingerprint research (obviously unsuccessfully). It was my understanding that 
string fp = session.ScanFingerprint(SessionOptionsInstance, "SHA-256")

would return the needed fingerprint.

Do I really need SFTP to avoid malicious attacks? If so, how do I find the necessary fingerprint?
martin

Re: (Complete Novice) SshHostKeyFingerprint error

You are mixing FTP TLS certificate fingerprints with SSH/SFTP host key fingerprints. As I do not really understand what are you trying to achieve, I cannot really advice further. Why are you trying to connect with SFTP, if you seem to need to use FTP?
ritjesman

(Complete Novice) SshHostKeyFingerprint error

I'm using WinSCP from within a C# WinForms app being developed in Visual Studio 2022 in Win10.
The app is for TLS/SSL cert auto renewal; FTP sessions will occur every 60–90 days and the sessions will only be open for 5–10 minutes (depending on host response times).
I can connect with the following (verified with a directory read): 
SessionOptions so = new SessionOptions();
so.HostName = "server220.web-hosting.com";
so.UserName = "id";
so.Password = "pw";
so.PortNumber = 21;
so.Protocol = Protocol.Ftp;
using (Session sess = new Session()){//do work}

Even though vulnerability to malicious attack is limited in this situation I would prefer a secure session. Lacking a host fingerprint I obtained it via sess.ScanFingerprint(so, "SHA-256") which returned: 
16:c0:dd:71:d3:9a:18:be:3f:7a:ed:68:69:c5:71:d6:ba:03:dc:15:82:58:0b:dd:5d:27:3a:58:c1:03:b8:e5

I then ran: 
SessionOptions so = new SessionOptions();
so.HostName = "server220.web-hosting.com";
so.UserName = "id";
so.Password = "pw";
so.PortNumber = 21;
so.Protocol = Protocol.Sftp;
so.FtpSecure = FtpSecure.Explicit;
so.SshHostKeyFingerprint = "ssh-rsa 2048 16:c0:dd:71:d3:9a:18:be:3f:7a:ed:68:69:c5:71:d6:ba:03:dc:15:82:58:0b:dd:5d:27:3a:58:c1:03:b8:e5";
using (Session sess = new Session()){// do work}

which throws this error: 
FTP conncct error:: System.ArgumentException: SSH host key fingerprint "ssh-rsa 2048 16:c0:dd:71:d3:9a:18:be:3f:7a:ed:68:69:c5:71:d6:ba:03:dc:15:82:58:0b:dd:5d:27:3a:58:c1:03:b8:e5" 

does not match pattern 

/((ssh-rsa|ssh-dss|ssh-ed25519|ecdsa-sha2-nistp(256|384|521))( |-))?(\d+ )?(([0-9a-fA-F]{2}(:|-)){15}[0-9a-fA-F]{2}|[0-9a-zA-Z+/\-_]{43}=?)(;((ssh-rsa|ssh-dss|ssh-ed25519|ecdsa-sha2-nistp(256|384|521))( |-))?(\d+ )?(([0-9a-fA-F]{2}(:|-)){15}[0-9a-fA-F]{2}|[0-9a-zA-Z+/\-_]{43}=?))*/

   at WinSCP.SessionOptions.SetSshHostKeyFingerprint(String s)

   at WinSCP.SessionOptions.set_SshHostKeyFingerprint(String value)

   at App_UI.Context..ctor(String[] tsArgs) in E:\TLS_SSL Cert Renewal\App_UI\Context.cs:line 58

I've obviously misunderstood something ... any help will be appreciated.
Art H.

Documentation

Support

Associations

Follow Us