Fix SSL fingerprint prompt causing authentication timeout

CRITICAL FIX: The PBS client was waiting for interactive SSL certificate fingerprint confirmation, causing the installer to timeout during authentication testing. Changes to pbs-client-installer.sh: - Authentication test now pipes 'y' to auto-accept SSL fingerprints - Displays accepted fingerprint in logs for transparency - Added SSL certificate issues to error troubleshooting - References new test-connection.sh script in error messages New file: test-connection.sh - Parameterized diagnostic script for testing PBS connections - No hardcoded credentials (security best practice) - Handles SSL fingerprint acceptance interactively - Tests all 3 steps: reachability, auth, datastore access - Provides detailed error messages and guidance - Usage examples for both password and API token auth Updated CHANGELOG.md: - Documented SSL fingerprint auto-acceptance as critical fix - Listed all improvements since v1.0.0 - Highlighted test-connection.sh script addition Updated README.md: - Added comprehensive troubleshooting section - Documented test-connection.sh usage with examples - Explained 3-step connection verification process - Added SSL fingerprint handling instructions - Clarified timeout values for each step This resolves the "authentication hanging" issue where the login command was waiting indefinitely for user input on SSL fingerprint confirmation. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
2025-11-01 17:21:10 -05:00 · 2025-11-01 17:21:10 -05:00 · 2dbbf2a683
commit 2dbbf2a683
parent 8dab3d023f
4 changed files with 195 additions and 10 deletions
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@ -14,11 +14,15 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
  - Reinstall option with reconfiguration
  - Exit without changes option
 - 3-step connection verification process:
-  - Step 1: Server reachability test (5s timeout)
-  - Step 2: Authentication test (30s timeout)
+  - Step 1: Server reachability test (5s timeout with curl)
+  - Step 2: Authentication test with automatic SSL fingerprint acceptance
  - Step 3: Datastore access verification
 - Display available block devices when invalid device is entered
 - Step-by-step progress indicators during connection testing
+- `test-connection.sh` - Diagnostic script for testing PBS connections manually
+  - Parameterized for security (no hardcoded credentials)
+  - Tests server reachability, authentication, and datastore access
+  - Handles SSL fingerprint acceptance interactively

 ### Changed
 - Installation instructions now use `git clone` instead of `wget`
@ -27,8 +31,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Block device detection now strips btrfs subvolume notation (e.g., `[/@]`)
 - Connection test succeeds if authentication works, even if no backups exist yet
 - More specific error messages based on which step of connection test fails
+- SSL certificate fingerprints are now automatically accepted during setup
+- Reduced authentication timeout from 30s to 15s

 ### Fixed
+- **CRITICAL**: SSL fingerprint prompt no longer causes authentication timeout
+  - Script now automatically accepts SSL fingerprints by piping 'y' to login
+  - This was the root cause of "authentication hanging" issues
 - Script no longer hangs indefinitely when PBS server is unreachable
 - Block device auto-detection now correctly handles btrfs subvolumes
 - Invalid device paths like `/dev/mapper/root[/@]` are now properly cleaned
--- a/README.md
+++ b/README.md
@ -253,27 +253,71 @@ sudo cp /path/to/saved/encryption-key.json /root/.config/proxmox-backup/

 ## Troubleshooting

+### Connection Test Script
+
+If you encounter connection issues, use the included diagnostic script:
+
+```bash
+./test-connection.sh <server> <port> <datastore> <username> <realm> <password-or-token>
+```
+
+**Examples:**
+
+With username/password:
+```bash
+./test-connection.sh 192.168.1.181 8007 DEAD-BACKUP root pam mypassword
+```
+
+With API token:
+```bash
+./test-connection.sh 192.168.1.181 8007 DEAD-BACKUP root pam backup-token token-secret-here
+```
+
+The script will:
+- Test server reachability
+- Handle SSL certificate fingerprint acceptance
+- Test authentication
+- Verify datastore access
+- Provide detailed error messages
+
 ### Connection Test Fails

-The installer tests the connection with a 30-second timeout. If it fails, you'll see specific error messages:
+The installer tests the connection with a 3-step process:

-**Timeout errors** (30+ seconds):
+**Step 1 - Server Reachability (5s timeout):**
 - PBS server is unreachable (check IP/hostname)
 - Firewall blocking port (default: 8007)
 - Network connectivity issues

-**Authentication errors** (immediate failure):
+**Step 2 - Authentication (15s timeout):**
 - Invalid credentials (username/password/token)
+- SSL certificate fingerprint issues (automatically handled)
+- API token format errors
+
+**Step 3 - Datastore Access:**
 - Datastore does not exist on server
 - User lacks permissions for the datastore

-Check your PBS server is accessible:
+**Quick checks:**
 ```bash
+# Test server reachability
 ping 192.168.1.181
 curl -k https://192.168.1.181:8007
+
+# Verify credentials in PBS web interface
+# Check datastore name matches exactly
 ```

-Verify credentials on PBS web interface.
+**SSL Certificate Fingerprints:**
+
+The installer automatically accepts SSL fingerprints during setup. If you need to manually accept a fingerprint:
+
+```bash
+export PBS_REPOSITORY="root@pam@192.168.1.181:8007:DEAD-BACKUP"
+export PBS_PASSWORD="your-password"
+proxmox-backup-client login
+# Answer 'y' when prompted to accept the fingerprint
+```

 ### Installation Fails on Ubuntu 22.04

--- a/pbs-client-installer.sh
+++ b/pbs-client-installer.sh
@ -516,12 +516,18 @@ test_connection() {
    fi
    log "Server is reachable"

-    # Step 2: Test authentication
+    # Step 2: Test authentication and handle SSL fingerprint
    info "Step 2/3: Testing authentication..."

    # Use the 'login' command which tests authentication and stores a ticket
+    # Automatically accept SSL fingerprint by piping 'y'
    local test_output
-    if test_output=$(timeout 15 proxmox-backup-client login 2>&1); then
+    if test_output=$(echo "y" | timeout 15 proxmox-backup-client login 2>&1); then
+        # Check if fingerprint was accepted
+        if echo "$test_output" | grep -q "fingerprint:"; then
+            local fingerprint=$(echo "$test_output" | grep "fingerprint:" | head -1 | awk '{print $2}')
+            info "SSL fingerprint accepted: ${fingerprint}"
+        fi
        log "Authentication successful"
    else
        local exit_code=$?
@ -529,7 +535,7 @@ test_connection() {

        if [ $exit_code -eq 124 ]; then
            error "Authentication test timed out"
-            error "Server is reachable but authentication is hanging"
+            error "This might indicate a network issue or server problem"
        else
            error "Authentication failed"
            # Show the actual error from PBS client
@ -545,12 +551,14 @@ test_connection() {
        error "  - Datastore '${PBS_DATASTORE}' does not exist"
        error "  - User lacks permissions for the datastore"
        error "  - API token is not properly formatted"
+        error "  - SSL certificate issues"
        echo
        info "Troubleshooting:"
        echo "  1. Verify credentials in PBS web interface"
        echo "  2. Check datastore name: ${PBS_DATASTORE}"
        echo "  3. Verify user has backup permissions"
        echo "  4. For API tokens, format is: username@realm!tokenname"
+        echo "  5. Try the test-connection.sh script for detailed diagnostics"
        echo
        info "Debug info:"
        echo "  Repository: ${PBS_REPOSITORY}"
--- a/test-connection.sh
+++ b/test-connection.sh
@ -0,0 +1,124 @@
+#!/bin/bash
+
+# PBS Client Connection Test Script
+# This script helps diagnose connection issues with Proxmox Backup Server
+
+# Usage:
+#   ./test-connection.sh <server> <port> <datastore> <username> <realm> <password>
+#   or
+#   ./test-connection.sh <server> <port> <datastore> <username> <realm> <token-name> <token-secret>
+
+if [ $# -lt 6 ]; then
+    echo "Usage:"
+    echo "  Test with username/password:"
+    echo "    $0 <server> <port> <datastore> <username> <realm> <password>"
+    echo ""
+    echo "  Test with API token:"
+    echo "    $0 <server> <port> <datastore> <username> <realm> <token-name> <token-secret>"
+    echo ""
+    echo "Examples:"
+    echo "  $0 192.168.1.181 8007 DEAD-BACKUP root pam mypassword"
+    echo "  $0 192.168.1.181 8007 DEAD-BACKUP root pam backup-token a1b2c3d4-e5f6-7890"
+    exit 1
+fi
+
+SERVER="$1"
+PORT="$2"
+DATASTORE="$3"
+USERNAME="$4"
+REALM="$5"
+
+# Detect if this is password or token authentication
+if [ $# -eq 6 ]; then
+    # Username/Password
+    PASSWORD="$6"
+    REPO="${USERNAME}@${REALM}@${SERVER}:${PORT}:${DATASTORE}"
+    AUTH_TYPE="password"
+elif [ $# -eq 7 ]; then
+    # API Token
+    TOKEN_NAME="$6"
+    TOKEN_SECRET="$7"
+    REPO="${USERNAME}@${REALM}!${TOKEN_NAME}@${SERVER}:${PORT}:${DATASTORE}"
+    PASSWORD="$TOKEN_SECRET"
+    AUTH_TYPE="token"
+else
+    echo "Error: Invalid number of arguments"
+    exit 1
+fi
+
+echo "=== PBS Client Connection Test ==="
+echo "Authentication Type: $AUTH_TYPE"
+echo "Repository: $REPO"
+echo ""
+
+export PBS_REPOSITORY="$REPO"
+export PBS_PASSWORD="$PASSWORD"
+
+# Test 1: Check if server is reachable
+echo "Test 1: Server Reachability"
+echo "----------------------------"
+if timeout 5 curl -sk --max-time 5 "https://${SERVER}:${PORT}" >/dev/null 2>&1; then
+    echo "✓ Server is reachable at https://${SERVER}:${PORT}"
+else
+    echo "✗ Server is NOT reachable"
+    echo "  Check network connectivity and firewall settings"
+    exit 1
+fi
+echo ""
+
+# Test 2: Check for SSL fingerprint requirement
+echo "Test 2: SSL Certificate Check"
+echo "------------------------------"
+echo "Attempting login to check for SSL fingerprint prompt..."
+LOGIN_OUTPUT=$(timeout 10 proxmox-backup-client login 2>&1)
+LOGIN_EXIT=$?
+
+if echo "$LOGIN_OUTPUT" | grep -q "fingerprint:"; then
+    echo "⚠ SSL certificate fingerprint confirmation required"
+    FINGERPRINT=$(echo "$LOGIN_OUTPUT" | grep "fingerprint:" | head -1 | awk '{print $2}')
+    echo "  Fingerprint: $FINGERPRINT"
+    echo ""
+    echo "To fix this, you need to accept the fingerprint. Options:"
+    echo "  1. Run this command interactively once:"
+    echo "     export PBS_REPOSITORY='$REPO'"
+    echo "     export PBS_PASSWORD='***'"
+    echo "     proxmox-backup-client login"
+    echo ""
+    echo "  2. Or use the --fingerprint flag in commands"
+    echo ""
+    echo "Would you like to accept this fingerprint now? (y/n)"
+    read -r ACCEPT
+    if [[ "$ACCEPT" == "y" || "$ACCEPT" == "Y" ]]; then
+        echo "y" | proxmox-backup-client login
+        if [ $? -eq 0 ]; then
+            echo "✓ Fingerprint accepted and login successful"
+        else
+            echo "✗ Login failed even after accepting fingerprint"
+            exit 1
+        fi
+    else
+        echo "Fingerprint not accepted. Cannot continue tests."
+        exit 1
+    fi
+elif [ $LOGIN_EXIT -eq 0 ]; then
+    echo "✓ Login successful (no fingerprint prompt)"
+else
+    echo "✗ Login failed"
+    echo "$LOGIN_OUTPUT"
+    exit 1
+fi
+echo ""
+
+# Test 3: List backup groups
+echo "Test 3: Datastore Access"
+echo "------------------------"
+if proxmox-backup-client list 2>&1; then
+    echo ""
+    echo "✓ Successfully accessed datastore"
+else
+    echo "⚠ Could not list backup groups (this is normal if no backups exist)"
+fi
+echo ""
+
+echo "=== All Tests Passed ==="
+echo "Your PBS client is properly configured!"