3

I want to use SFTP to transfer files from Android to a Linux box using Public Key authentication rather than a traditional user name and password. Ideally I would like to use ES File Explorer (as I use it for everything else).

Can anyone tell me how to generate a suitable public/private key pair to allow ES File Explorer to authenticate with the SFTP server?

  • When I try to connect to an SFTP server using a Private Key, I can select a file containing the key, but when I click OK, I get the message "Error, cannot find the SFTP(mysite.com) server".
  • I know that ES File Explorer is capable of using SFTP because it worked when I was using password authentication. Now that I have switched passwords off on the server, it reports "Login fails. This may be caused by: Auth fail", which is pretty much what I would expect.
  • I know that the Android phone still has connectivity to the SSH server, because I can connect to it using Connectbot with Public Key authentication.
  • I know that SFTP is still working over SSH, because I can connect to it and transfer files using BitKinex running on a PC.
  • CLARIFICATION: I am not running a firewall on the Android phone.
  • CLARIFICATION: When the phone fails to connect, the SFTP server logs Received disconnect from my.ip.ad.dr: 3: com.jcraft.jsch.JSchException: Auth fail [preauth]

I have successfully authenticated with the server using 2048-bit keys generated by PuTTY KeyGen, both in PuTTY's .ppk format (in PuTTY itself) and exported to OpenSSH format (for BitKinex). These keys didn't work; neither did exporting them to SSH.com format. I've also got OpenSSH / OpenSSL available on the Linux box as an alternative for key generation. Connectbot manages its own keys, but doesn't seem to be able to export the private key (option greyed out).

I guess the problem could either be that I am using the wrong key file format, or that I've got the wrong options set on the key itself. I haven't been able to find any instructions in the ES File Explorer documentation or on Google.

It ought not to make a difference, but I am using a Huawei Ascend P2 with Android 4.1.2. It is not rooted (and I'm not going to). The linux box is a Raspberry Pi with OpenSSH 6.0p1 Debian-4+deb7u2.

Improve this question

1 Answer 1

Reset to default
4

Your question made me try to use the same configuration.

Solution

Generate your key pair in OpenSSH key file format, I used my linux workstation:

 ssh-keygen -t rsa -C "KEYNAME"

(I left passphrase empty but I think it will work with it too, add the public key to your host:

 cat ~/.ssh/id_rsa.pub >> ~/.ssh/authorized_keys

(Assuming that's the same machine you want to connect to) Copy private key id_rsa to your phone and use that one. :)

I found the clue on logcat:

 W/System.err(27250): com.jcraft.jsch.JSchException: invalid privatekey: /sdcard/key.ppk

and this answer brought me in the right direction.

How to copy private key from connectBot export workaround

Only private keys without passphrase can be copied, so you can change password and set it empty, this key is NOT compatible with ES File Explorer.

Improve this answer
6
  • The ConnectBot export workaround did work in that once the password was removed, it did let me export the private key onto the clipboard. However, I wasn't able to use the result either in ES File Explorer (same error message as before), or PuTTY (PuTTY KeyGen didn't recognise the file format). However, exporting the public key did result in a file that worked on the server, and allowed me to connect using ConnectBot. I tried both 1024 & 2048 bit keys, with and without original passwords. I've also added a little more info to my question.
    – JRI
    Commented Sep 2, 2014 at 23:30
  • After some further experimentation, the exported private keys did all work with BitKinex. They still don't work in ES File Explorer though...
    – JRI
    Commented Sep 2, 2014 at 23:43
  • Sorry it looks like when yesterday I was able to connect it was using a previously enstablished session with password. Good news I found how to connect with private/public key, I updated my answer.
    – Crayon
    Commented Sep 3, 2014 at 13:30
  • Thanks for your efforts - I can confirm your answer is working for me. Disappointingly though, it seems that passphrases are not supported by ES File Explorer (I'll see if I can raise it as a feature request). After some experimentation, RSA1 and ECDSA keys did not work at all, but DSA and RSA2 keys work so long as no passphrase is specified. It looks like RSA is the way to go
    – JRI
    Commented Sep 3, 2014 at 20:41
  • Np ;) Check again about passphrase, it worked for me using the same procedure. ES File Explorer saves the passphrase and stores it in plain text under it's data folder so not a big security improvement :D
    – Crayon
    Commented Sep 3, 2014 at 21:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .