From 2dbbf2a683b1534d6069d16ed9bd657c340b51df Mon Sep 17 00:00:00 2001 From: zaphod-black Date: Sat, 1 Nov 2025 17:21:10 -0500 Subject: [PATCH] Fix SSL fingerprint prompt causing authentication timeout MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit CRITICAL FIX: The PBS client was waiting for interactive SSL certificate fingerprint confirmation, causing the installer to timeout during authentication testing. Changes to pbs-client-installer.sh: - Authentication test now pipes 'y' to auto-accept SSL fingerprints - Displays accepted fingerprint in logs for transparency - Added SSL certificate issues to error troubleshooting - References new test-connection.sh script in error messages New file: test-connection.sh - Parameterized diagnostic script for testing PBS connections - No hardcoded credentials (security best practice) - Handles SSL fingerprint acceptance interactively - Tests all 3 steps: reachability, auth, datastore access - Provides detailed error messages and guidance - Usage examples for both password and API token auth Updated CHANGELOG.md: - Documented SSL fingerprint auto-acceptance as critical fix - Listed all improvements since v1.0.0 - Highlighted test-connection.sh script addition Updated README.md: - Added comprehensive troubleshooting section - Documented test-connection.sh usage with examples - Explained 3-step connection verification process - Added SSL fingerprint handling instructions - Clarified timeout values for each step This resolves the "authentication hanging" issue where the login command was waiting indefinitely for user input on SSL fingerprint confirmation. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude --- CHANGELOG.md | 13 ++++- README.md | 54 +++++++++++++++-- pbs-client-installer.sh | 14 ++++- test-connection.sh | 124 ++++++++++++++++++++++++++++++++++++++++ 4 files changed, 195 insertions(+), 10 deletions(-) create mode 100755 test-connection.sh diff --git a/CHANGELOG.md b/CHANGELOG.md index 2d9f468..643df13 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -14,11 +14,15 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 - Reinstall option with reconfiguration - Exit without changes option - 3-step connection verification process: - - Step 1: Server reachability test (5s timeout) - - Step 2: Authentication test (30s timeout) + - Step 1: Server reachability test (5s timeout with curl) + - Step 2: Authentication test with automatic SSL fingerprint acceptance - Step 3: Datastore access verification - Display available block devices when invalid device is entered - Step-by-step progress indicators during connection testing +- `test-connection.sh` - Diagnostic script for testing PBS connections manually + - Parameterized for security (no hardcoded credentials) + - Tests server reachability, authentication, and datastore access + - Handles SSL fingerprint acceptance interactively ### Changed - Installation instructions now use `git clone` instead of `wget` @@ -27,8 +31,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 - Block device detection now strips btrfs subvolume notation (e.g., `[/@]`) - Connection test succeeds if authentication works, even if no backups exist yet - More specific error messages based on which step of connection test fails +- SSL certificate fingerprints are now automatically accepted during setup +- Reduced authentication timeout from 30s to 15s ### Fixed +- **CRITICAL**: SSL fingerprint prompt no longer causes authentication timeout + - Script now automatically accepts SSL fingerprints by piping 'y' to login + - This was the root cause of "authentication hanging" issues - Script no longer hangs indefinitely when PBS server is unreachable - Block device auto-detection now correctly handles btrfs subvolumes - Invalid device paths like `/dev/mapper/root[/@]` are now properly cleaned diff --git a/README.md b/README.md index 056d7c2..326fd06 100644 --- a/README.md +++ b/README.md @@ -253,27 +253,71 @@ sudo cp /path/to/saved/encryption-key.json /root/.config/proxmox-backup/ ## Troubleshooting +### Connection Test Script + +If you encounter connection issues, use the included diagnostic script: + +```bash +./test-connection.sh +``` + +**Examples:** + +With username/password: +```bash +./test-connection.sh 192.168.1.181 8007 DEAD-BACKUP root pam mypassword +``` + +With API token: +```bash +./test-connection.sh 192.168.1.181 8007 DEAD-BACKUP root pam backup-token token-secret-here +``` + +The script will: +- Test server reachability +- Handle SSL certificate fingerprint acceptance +- Test authentication +- Verify datastore access +- Provide detailed error messages + ### Connection Test Fails -The installer tests the connection with a 30-second timeout. If it fails, you'll see specific error messages: +The installer tests the connection with a 3-step process: -**Timeout errors** (30+ seconds): +**Step 1 - Server Reachability (5s timeout):** - PBS server is unreachable (check IP/hostname) - Firewall blocking port (default: 8007) - Network connectivity issues -**Authentication errors** (immediate failure): +**Step 2 - Authentication (15s timeout):** - Invalid credentials (username/password/token) +- SSL certificate fingerprint issues (automatically handled) +- API token format errors + +**Step 3 - Datastore Access:** - Datastore does not exist on server - User lacks permissions for the datastore -Check your PBS server is accessible: +**Quick checks:** ```bash +# Test server reachability ping 192.168.1.181 curl -k https://192.168.1.181:8007 + +# Verify credentials in PBS web interface +# Check datastore name matches exactly ``` -Verify credentials on PBS web interface. +**SSL Certificate Fingerprints:** + +The installer automatically accepts SSL fingerprints during setup. If you need to manually accept a fingerprint: + +```bash +export PBS_REPOSITORY="root@pam@192.168.1.181:8007:DEAD-BACKUP" +export PBS_PASSWORD="your-password" +proxmox-backup-client login +# Answer 'y' when prompted to accept the fingerprint +``` ### Installation Fails on Ubuntu 22.04 diff --git a/pbs-client-installer.sh b/pbs-client-installer.sh index 7f81d29..64d3492 100755 --- a/pbs-client-installer.sh +++ b/pbs-client-installer.sh @@ -516,12 +516,18 @@ test_connection() { fi log "Server is reachable" - # Step 2: Test authentication + # Step 2: Test authentication and handle SSL fingerprint info "Step 2/3: Testing authentication..." # Use the 'login' command which tests authentication and stores a ticket + # Automatically accept SSL fingerprint by piping 'y' local test_output - if test_output=$(timeout 15 proxmox-backup-client login 2>&1); then + if test_output=$(echo "y" | timeout 15 proxmox-backup-client login 2>&1); then + # Check if fingerprint was accepted + if echo "$test_output" | grep -q "fingerprint:"; then + local fingerprint=$(echo "$test_output" | grep "fingerprint:" | head -1 | awk '{print $2}') + info "SSL fingerprint accepted: ${fingerprint}" + fi log "Authentication successful" else local exit_code=$? @@ -529,7 +535,7 @@ test_connection() { if [ $exit_code -eq 124 ]; then error "Authentication test timed out" - error "Server is reachable but authentication is hanging" + error "This might indicate a network issue or server problem" else error "Authentication failed" # Show the actual error from PBS client @@ -545,12 +551,14 @@ test_connection() { error " - Datastore '${PBS_DATASTORE}' does not exist" error " - User lacks permissions for the datastore" error " - API token is not properly formatted" + error " - SSL certificate issues" echo info "Troubleshooting:" echo " 1. Verify credentials in PBS web interface" echo " 2. Check datastore name: ${PBS_DATASTORE}" echo " 3. Verify user has backup permissions" echo " 4. For API tokens, format is: username@realm!tokenname" + echo " 5. Try the test-connection.sh script for detailed diagnostics" echo info "Debug info:" echo " Repository: ${PBS_REPOSITORY}" diff --git a/test-connection.sh b/test-connection.sh new file mode 100755 index 0000000..2d4152c --- /dev/null +++ b/test-connection.sh @@ -0,0 +1,124 @@ +#!/bin/bash + +# PBS Client Connection Test Script +# This script helps diagnose connection issues with Proxmox Backup Server + +# Usage: +# ./test-connection.sh +# or +# ./test-connection.sh + +if [ $# -lt 6 ]; then + echo "Usage:" + echo " Test with username/password:" + echo " $0 " + echo "" + echo " Test with API token:" + echo " $0 " + echo "" + echo "Examples:" + echo " $0 192.168.1.181 8007 DEAD-BACKUP root pam mypassword" + echo " $0 192.168.1.181 8007 DEAD-BACKUP root pam backup-token a1b2c3d4-e5f6-7890" + exit 1 +fi + +SERVER="$1" +PORT="$2" +DATASTORE="$3" +USERNAME="$4" +REALM="$5" + +# Detect if this is password or token authentication +if [ $# -eq 6 ]; then + # Username/Password + PASSWORD="$6" + REPO="${USERNAME}@${REALM}@${SERVER}:${PORT}:${DATASTORE}" + AUTH_TYPE="password" +elif [ $# -eq 7 ]; then + # API Token + TOKEN_NAME="$6" + TOKEN_SECRET="$7" + REPO="${USERNAME}@${REALM}!${TOKEN_NAME}@${SERVER}:${PORT}:${DATASTORE}" + PASSWORD="$TOKEN_SECRET" + AUTH_TYPE="token" +else + echo "Error: Invalid number of arguments" + exit 1 +fi + +echo "=== PBS Client Connection Test ===" +echo "Authentication Type: $AUTH_TYPE" +echo "Repository: $REPO" +echo "" + +export PBS_REPOSITORY="$REPO" +export PBS_PASSWORD="$PASSWORD" + +# Test 1: Check if server is reachable +echo "Test 1: Server Reachability" +echo "----------------------------" +if timeout 5 curl -sk --max-time 5 "https://${SERVER}:${PORT}" >/dev/null 2>&1; then + echo "✓ Server is reachable at https://${SERVER}:${PORT}" +else + echo "✗ Server is NOT reachable" + echo " Check network connectivity and firewall settings" + exit 1 +fi +echo "" + +# Test 2: Check for SSL fingerprint requirement +echo "Test 2: SSL Certificate Check" +echo "------------------------------" +echo "Attempting login to check for SSL fingerprint prompt..." +LOGIN_OUTPUT=$(timeout 10 proxmox-backup-client login 2>&1) +LOGIN_EXIT=$? + +if echo "$LOGIN_OUTPUT" | grep -q "fingerprint:"; then + echo "⚠ SSL certificate fingerprint confirmation required" + FINGERPRINT=$(echo "$LOGIN_OUTPUT" | grep "fingerprint:" | head -1 | awk '{print $2}') + echo " Fingerprint: $FINGERPRINT" + echo "" + echo "To fix this, you need to accept the fingerprint. Options:" + echo " 1. Run this command interactively once:" + echo " export PBS_REPOSITORY='$REPO'" + echo " export PBS_PASSWORD='***'" + echo " proxmox-backup-client login" + echo "" + echo " 2. Or use the --fingerprint flag in commands" + echo "" + echo "Would you like to accept this fingerprint now? (y/n)" + read -r ACCEPT + if [[ "$ACCEPT" == "y" || "$ACCEPT" == "Y" ]]; then + echo "y" | proxmox-backup-client login + if [ $? -eq 0 ]; then + echo "✓ Fingerprint accepted and login successful" + else + echo "✗ Login failed even after accepting fingerprint" + exit 1 + fi + else + echo "Fingerprint not accepted. Cannot continue tests." + exit 1 + fi +elif [ $LOGIN_EXIT -eq 0 ]; then + echo "✓ Login successful (no fingerprint prompt)" +else + echo "✗ Login failed" + echo "$LOGIN_OUTPUT" + exit 1 +fi +echo "" + +# Test 3: List backup groups +echo "Test 3: Datastore Access" +echo "------------------------" +if proxmox-backup-client list 2>&1; then + echo "" + echo "✓ Successfully accessed datastore" +else + echo "⚠ Could not list backup groups (this is normal if no backups exist)" +fi +echo "" + +echo "=== All Tests Passed ===" +echo "Your PBS client is properly configured!"