[GH-ISSUE #2229] Bug: amnezia-sftp container hangs with modern OpenSSH clients (OpenSSH 10.0+) #991

New issue

Open

opened 2026-10-13 20:32:30 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-13 20:32:30 +00:00

Owner

Originally created by @Vadim000009 on GitHub (Feb 17, 2026).
Original GitHub issue: https://github.com/amnezia-vpn/amnezia-client/issues/2229

Description
The amnezia-sftp Docker image is based on atmoz/sftp which hasn't been updated for 19 months. The OpenSSH server inside (8.4p1, Debian 11 bullseye) is incompatible with modern OpenSSH clients (10.0+, shipping with Debian 13/Trixie and Ubuntu 24.04+).
When connecting via SFTP, authentication succeeds but the session hangs immediately after Sending subsystem: sftp — no data is transferred, and the connection eventually times out.

Steps to Reproduce

Set up Amnezia VPN server on Debian 13 (Trixie)
Enable SFTP service through Amnezia client
Attempt to connect: sftp -P 222 sftp_user@
Enter password — authentication succeeds
Session hangs indefinitely after "Connected"

Debug output (client side)

debug1: Sending subsystem: sftp
debug1: client_global_hostkeys_prove_confirm: server used untrusted RSA 
signature algorithm ssh-rsa for key 1, disregarding

Session hangs at this point.

Server side symptoms
Multiple zombie sshd: sftp_user@notty processes accumulate, each consuming ~10-20% CPU:

sftp_us+  59 22.3  0.3  13572  3468 ?  Rs  sshd: sftp_user@notty
sftp_us+  63 21.5  0.3  13572  3364 ?  Rs  sshd: sftp_user@notty
sftp_us+  67 14.8  0.3  13572  3416 ?  Rs  sshd: sftp_user@notty

Root Cause
The amnezia-sftp Dockerfile inherits from atmoz/sftp which uses Debian 11 (bullseye) as the base image. The OpenSSH 8.4p1 included in this image has compatibility issues with OpenSSH 10.0+ clients, likely related to deprecated key exchange algorithms and RSA signature handling.

Fix
Update the base image in /opt/amnezia/amnezia-sftp/Dockerfile from atmoz/sftp to a fresh build based on debian:bookworm-slim:

FROM debian:bookworm-slim
LABEL maintainer="AmneziaVPN"

RUN apt-get update && \
    apt-get -y install openssh-server && \
    rm -rf /var/lib/apt/lists/* && \
    mkdir -p /var/run/sshd && \
    rm -f /etc/ssh/ssh_host_*key*

COPY files/sshd_config /etc/ssh/sshd_config
COPY files/create-sftp-user /usr/local/bin/
COPY files/entrypoint /

EXPOSE 22
ENTRYPOINT ["/entrypoint"]

This upgrades OpenSSH from 8.4p1 to 9.2p1 (Debian 12 bookworm), which resolves the compatibility issue with modern clients.
The existing files/sshd_config, files/create-sftp-user, and files/entrypoint scripts from the original atmoz/sftp image are fully compatible and require no changes.
Additionally, the default sshd_config should include a relaxed umask for better compatibility with Windows SSHFS/rclone clients:
ForceCommand internal-sftp -u 0000

Affected Files

client/server_defs/server_protocol_sftp.h or equivalent Dockerfile definition
/opt/amnezia/amnezia-sftp/Dockerfile (on deployed servers)

Environment

Server OS: Debian 13 (Trixie), also affects Ubuntu 24.04+
Client OS: Windows 10/11 with Amnezia 4.8.12.9
amnezia-sftp image age: 19 months
OpenSSH in old image: 8.4p1 (Debian 11)
OpenSSH in fixed image: 9.2p1 (Debian 12)

Originally created by @Vadim000009 on GitHub (Feb 17, 2026). Original GitHub issue: https://github.com/amnezia-vpn/amnezia-client/issues/2229 **Description** The amnezia-sftp Docker image is based on atmoz/sftp which hasn't been updated for 19 months. The OpenSSH server inside (8.4p1, Debian 11 bullseye) is incompatible with modern OpenSSH clients (10.0+, shipping with Debian 13/Trixie and Ubuntu 24.04+). When connecting via SFTP, authentication succeeds but the session hangs immediately after Sending subsystem: sftp — no data is transferred, and the connection eventually times out. **Steps to Reproduce** 1. Set up Amnezia VPN server on Debian 13 (Trixie) 2. Enable SFTP service through Amnezia client 3. Attempt to connect: sftp -P 222 sftp_user@<server> 4. Enter password — authentication succeeds 5. Session hangs indefinitely after "Connected" **Debug output (client side)** ``` debug1: Sending subsystem: sftp debug1: client_global_hostkeys_prove_confirm: server used untrusted RSA signature algorithm ssh-rsa for key 1, disregarding ``` Session hangs at this point. **Server side symptoms** Multiple zombie sshd: sftp_user@notty processes accumulate, each consuming ~10-20% CPU: ``` sftp_us+ 59 22.3 0.3 13572 3468 ? Rs sshd: sftp_user@notty sftp_us+ 63 21.5 0.3 13572 3364 ? Rs sshd: sftp_user@notty sftp_us+ 67 14.8 0.3 13572 3416 ? Rs sshd: sftp_user@notty ``` **Root Cause** The amnezia-sftp Dockerfile inherits from atmoz/sftp which uses Debian 11 (bullseye) as the base image. The OpenSSH 8.4p1 included in this image has compatibility issues with OpenSSH 10.0+ clients, likely related to deprecated key exchange algorithms and RSA signature handling. **Fix** Update the base image in /opt/amnezia/amnezia-sftp/Dockerfile from atmoz/sftp to a fresh build based on debian:bookworm-slim: ``` FROM debian:bookworm-slim LABEL maintainer="AmneziaVPN" RUN apt-get update && \ apt-get -y install openssh-server && \ rm -rf /var/lib/apt/lists/* && \ mkdir -p /var/run/sshd && \ rm -f /etc/ssh/ssh_host_*key* COPY files/sshd_config /etc/ssh/sshd_config COPY files/create-sftp-user /usr/local/bin/ COPY files/entrypoint / EXPOSE 22 ENTRYPOINT ["/entrypoint"] ``` This upgrades OpenSSH from 8.4p1 to 9.2p1 (Debian 12 bookworm), which resolves the compatibility issue with modern clients. The existing files/sshd_config, files/create-sftp-user, and files/entrypoint scripts from the original atmoz/sftp image are fully compatible and require no changes. Additionally, the default sshd_config should include a relaxed umask for better compatibility with Windows SSHFS/rclone clients: `ForceCommand internal-sftp -u 0000` **Affected Files** - client/server_defs/server_protocol_sftp.h or equivalent Dockerfile definition - /opt/amnezia/amnezia-sftp/Dockerfile (on deployed servers) **Environment** - Server OS: Debian 13 (Trixie), also affects Ubuntu 24.04+ - Client OS: Windows 10/11 with Amnezia 4.8.12.9 - amnezia-sftp image age: 19 months - OpenSSH in old image: 8.4p1 (Debian 11) - OpenSSH in fixed image: 9.2p1 (Debian 12)

No labels

pull-request

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

amnezia-vpn/amnezia-client#991

No description provided.

Rows
Columns