Persistent "Connection closed by remote host. Is borg working on the server?" when trying to add new or existing database; local repos work fine. Client public SSH Key selection problem?

[juanejot]

Description

I was able to reproduce the issue.

1. Create an ssh key pair with ssh-keygen
2. cat .ssh/newkey_id_ed25519
3. Copy the output of the previous command.
4. While logged into borgbase.com, go to "SSH Keys" and tap "Add Key" to paste this new key into your set.
5. Still on borgbase.com, go to "Repositories" and add a "New Repo," selecting this new key under "Access" as a "Full Access" key. When all done configuring, BorgBase will congratulate you for making the new repo and provide the URL to access it. You can copy it now, or click the stacked rectangles icon to the left of the list of your repos, to copy it in the future.
   (The following three steps were suggested as a workaround by BorgBase support, and while it does get the passphrase to auto-populate in Vorta, it does not get Vorta to successfully connect).
6. Go to KWalletManager, find the "Vorta" entry (which you will have if you have previously set up a local backup), go into "Passwords" under it, invoke a pulldown menu, and select "New."
7. In the dialog box that comes up, enter the ssh URL you copied from BorgBase for your new repo.
8. Once the new entry is created, go to that entry, tap the "Show Contents," and enter and save (via the "Save" button in the lower right) the passphrase for your ssh key.
9. Open Vorta, where under a different profile from any local (or other) backups, under the "Repository" tab, you click the big red "+" button to add a repository.
10. In the correct place in the dialog box that comes up, enter the "ssh://" URL BorgBase gave you for your new repo. As soon as you do so (provided you followed steps 6-8), the passphrase will autopopulate. Decide whether you want an optional description, and hit the "Add" button on the bottom.
11. This dialog box will claim at the bottom "Unable to add your repository." and the main Vorta window will provide marginally more info at the bottom with "[Init Repo] ERROR: Connection closed by remote host. Is borg working on the server?"
12. Because I had (at BorgBase support advice) been able to successfully connect to the server using ssh -v [email protected], I reasoned that maybe the repo was initiated? This was backed up by the repo having a very small amount of "Usage" (under 10kb) listed on the BorgBase website. So I tried "Add an Existing Repository" in Vorta, too. Same result.

I have read the checklist inlcuded in the thread of issue #1104 (along with a whole lot of other documentation & FAQs covering borg, Vorta & BorgBase), and having followed all those directions and the advice of BorgBase support, I have not found an answer yet. So I followed BorgBase support's most recent suggestion & posted it here, as the developer is active between Vorta & BorgBase.

Local backups via Vorta work. And remote backups to BorgBase work via GNOME/pika-backup on different hardware (same base OS), it just isn't working via KDE Plasma (or on yet a different machine, XFCE/kwallet/Vorta).

Environment

• OS: Arch (rolling, currently kernel 6.12.7-arch1-1)
• Vorta version: 0.10.3-1
• Installed from: pacman (I've tried from Flatpak too; same result)
• Borg version: 1.4.0-3

Logs

2024-12-30 12:41:59,772 - vorta.i18n - DEBUG - Loading translation succeeded for ['en-Latn-US', 'en-US', 'en'].
2024-12-30 12:41:59,847 - vorta.views.source_tab - DEBUG - Added item number 0 from 1
2024-12-30 12:41:59,954 - root - INFO - Using NetworkManagerMonitor NetworkStatusMonitor implementation.
2024-12-30 12:41:59,970 - vorta.scheduler - DEBUG - Nothing scheduled for profile 2 because of unset repo.
2024-12-30 12:41:59,974 - vorta.scheduler - DEBUG - Nothing scheduled for profile 2 because of unset repo.
2024-12-30 12:41:59,978 - vorta.scheduler - DEBUG - Nothing scheduled for profile 2 because of unset repo.
2024-12-30 12:42:00,008 - vorta.borg.jobs_manager - DEBUG - Add job for site default
2024-12-30 12:42:00,008 - vorta.borg.jobs_manager - DEBUG - Start job on site: default
2024-12-30 12:42:00,010 - vorta.borg.borg_job - INFO - Running command /usr/bin/borg --version
2024-12-30 12:42:00,374 - vorta.borg.jobs_manager - DEBUG - Finish job for site: default
2024-12-30 12:42:00,375 - vorta.borg.jobs_manager - DEBUG - No more jobs for site: default
2024-12-30 12:42:00,375 - vorta.scheduler - DEBUG - Refreshing all scheduler timers
2024-12-30 12:42:00,379 - vorta.scheduler - INFO - Setting timer for profile 1
2024-12-30 12:42:00,381 - vorta.scheduler - DEBUG - Catching up by running job for Default (1)
2024-12-30 12:42:00,383 - vorta.scheduler - INFO - Starting background backup for Default
2024-12-30 12:42:00,385 - vorta.notifications - DEBUG - success notifications suppressed
2024-12-30 12:42:00,389 - vorta.keyring.abc - DEBUG - No module named 'objc'
2024-12-30 12:42:00,446 - vorta.keyring.abc - DEBUG - Using VortaKWallet5Keyring
2024-12-30 12:42:00,446 - vorta.borg.borg_job - DEBUG - Using VortaKWallet5Keyring keyring to store passwords.
2024-12-30 12:42:00,449 - vorta.keyring.kwallet - DEBUG - Retrieved password for repo /run/media/juanejot/LinUxSBackups/pika-lappy
2024-12-30 12:42:00,455 - vorta.scheduler - ERROR - Conditions for backup not met. Aborting.
2024-12-30 12:42:00,455 - vorta.scheduler - ERROR - Repo folder not mounted or moved.
2024-12-30 12:42:00,455 - vorta.notifications - DEBUG - notification not suppressed
2024-12-30 12:42:00,459 - vorta.scheduler - DEBUG - Paused 1 until 2024-12-30 13:42:00
2024-12-30 12:42:00,460 - vorta.scheduler - DEBUG - Nothing scheduled for profile 2 because of unset repo.
2024-12-30 12:42:05,201 - vorta.keyring.abc - DEBUG - No module named 'objc'
2024-12-30 12:42:05,203 - vorta.keyring.abc - DEBUG - Using VortaKWallet5Keyring
2024-12-30 12:42:08,948 - vorta.keyring.abc - DEBUG - No module named 'objc'
2024-12-30 12:42:08,950 - vorta.keyring.abc - DEBUG - Using VortaKWallet5Keyring
2024-12-30 12:42:08,954 - vorta.keyring.kwallet - DEBUG - Retrieved password for repo ssh://[reponame]@[reponame].repo.borgbase.com/./repo
2024-12-30 12:42:24,959 - vorta.keyring.abc - DEBUG - No module named 'objc'
2024-12-30 12:42:24,961 - vorta.keyring.abc - DEBUG - Using VortaKWallet5Keyring
2024-12-30 12:42:24,961 - vorta.borg.borg_job - DEBUG - Using VortaKWallet5Keyring keyring to store passwords.
2024-12-30 12:42:24,964 - vorta.keyring.kwallet - DEBUG - Retrieved password for repo ssh://[reponame]@[reponame].repo.borgbase.com/./repo
2024-12-30 12:42:24,967 - vorta.borg.jobs_manager - DEBUG - Add job for site default
2024-12-30 12:42:24,967 - vorta.borg.jobs_manager - DEBUG - Start job on site: default
2024-12-30 12:42:24,975 - vorta.borg.borg_job - INFO - Running command /usr/bin/borg init --info --log-json --encryption=repokey-blake2 ssh://[reponame]@[reponame].repo.borgbase.com/./repo
2024-12-30 12:42:26,022 - vorta.borg.borg_job - WARNING - Remote: [reponame]@[reponame].repo.borgbase.com: Permission denied (publickey,gssapi-keyex,gssapi-with-mic).
2024-12-30 12:42:26,029 - vorta.borg.borg_job - ERROR - Connection closed by remote host. Is borg working on the server?
2024-12-30 12:42:26,197 - vorta.borg.jobs_manager - DEBUG - Finish job for site: default
2024-12-30 12:42:26,198 - vorta.borg.jobs_manager - DEBUG - No more jobs for site: default
2024-12-30 12:42:36,248 - vorta.keyring.abc - DEBUG - No module named 'objc'
2024-12-30 12:42:36,249 - vorta.keyring.abc - DEBUG - Using VortaKWallet5Keyring
2024-12-30 12:42:36,253 - vorta.keyring.kwallet - DEBUG - Retrieved password for repo ssh://[reponame]@[reponame].repo.borgbase.com/./repo
2024-12-30 12:42:44,740 - vorta.keyring.abc - DEBUG - No module named 'objc'
2024-12-30 12:42:44,742 - vorta.keyring.abc - DEBUG - Using VortaKWallet5Keyring
2024-12-30 12:42:44,742 - vorta.borg.borg_job - DEBUG - Using VortaKWallet5Keyring keyring to store passwords.
2024-12-30 12:42:44,745 - vorta.keyring.kwallet - DEBUG - Retrieved password for repo ssh://[reponame]@[reponame].repo.borgbase.com/./repo
2024-12-30 12:42:44,754 - vorta.borg.borg_job - INFO - Running command /usr/bin/borg info --info --json --log-json ssh://[reponame]@[reponame].repo.borgbase.com/./repo
2024-12-30 12:42:45,887 - vorta.borg.borg_job - WARNING - Remote: [reponame]@[reponame].repo.borgbase.com: Permission denied (publickey,gssapi-keyex,gssapi-with-mic).
2024-12-30 12:42:45,892 - vorta.borg.borg_job - ERROR - Connection closed by remote host. Is borg working on the server?
2024-12-30 12:42:52,380 - vorta.borg.borg_job - DEBUG - Cancel job on site default
2024-12-30 12:42:52,380 - vorta.borg.jobs_manager - INFO - Finished cancelling all jobs

[m3nu]

Sorry for this bad experience you are having and that support wasn't able to help in this case.

As you see in the logs, Vorta will simply run the Borg commands listed. And if normal ssh works, so should Borg and Vorta. Maybe there is some security feature, like SELinux preventing access to the key?

Have you already tried running the borg commands from your logs with --debug? I.e.

/usr/bin/borg init --info --log-json --encryption=repokey-blake2 ssh://[reponame]@[reponame].repo.borgbase.com/./repo

[juanejot]

Thanks for your reply. Below is the log with the redacted reponame, and including the command after $. I was surprised to find that it felt it needed a "new" passphrase, but entered/reentered the one it had been using, did NOT require display for verification of it.

Trying to add the repo in Vorta after this exercise, still didn't work (same GUI output; I didn't get that log though).

Here's the log, as mentioned, for the command you suggest above:

$ /usr/bin/borg init --info --log-json --encryption=repokey-blake2 ssh://[reponame]@[reponame].repo.borgbase.com/./repo
{"type": "log_message", "time": 1735602767.071474, "message": "Initializing repository at \"ssh://[reponame]@[reponame].repo.borgbase.com/./repo\"", "levelname": "INFO", "name": "borg.archiver"}
Enter new passphrase: 
Enter same passphrase again: 
{"type": "question_prompt", "msgid": "BORG_DISPLAY_PASSPHRASE", "message": "Do you want your passphrase to be displayed for verification? [yN]: "}

{"type": "log_message", "time": 1735602797.58991, "message": "Remember your passphrase. Your data will be inaccessible without it.", "levelname": "INFO", "name": "borg.crypto.key"}
{"type": "log_message", "time": 1735602797.7449505, "message": "Key in \"<RemoteRepository ssh://[reponame]@[reponame].repo.borgbase.com/./repo>\" created.", "levelname": "INFO", "name": "borg.crypto.key"}
{"type": "log_message", "time": 1735602797.7451153, "message": "Keep this key safe. Your data will be inaccessible without it.", "levelname": "INFO", "name": "borg.crypto.key"}
{"type": "log_message", "time": 1735602799.0039852, "message": "Remote: Storage quota: 522 B out of 5.00 GB used.", "levelname": "INFO", "name": "borg.repository"}
{"type": "log_message", "time": 1735602798.1450355, "message": "Synchronizing chunks cache...", "levelname": "INFO", "name": "borg.cache"}
{"type": "log_message", "time": 1735602798.1452274, "message": "Archives: 0, w/ cached Idx: 0, w/ outdated Idx: 0, w/o cached Idx: 0.", "levelname": "INFO", "name": "borg.cache"}
{"type": "log_message", "time": 1735602798.230707, "message": "Done.", "levelname": "INFO", "name": "borg.cache"}
{"type": "log_message", "time": 1735602798.2444792, "message": "\nIMPORTANT: you will need both KEY AND PASSPHRASE to access this repo!\n\nKey storage location depends on the mode:\n- repokey modes: key is stored in the repository directory.\n- keyfile modes: key is stored in the home directory of this user.\n\nFor any mode, you should:\n1. Export the borg key and store the result at a safe place:\n   borg key export           REPOSITORY encrypted-key-backup\n   borg key export --paper   REPOSITORY encrypted-key-backup.txt\n   borg key export --qr-html REPOSITORY encrypted-key-backup.html\n2. Write down the borg key passphrase and store it at safe place.\n", "levelname": "WARNING", "name": "borg.archiver"}

EDIT: Sorry, reread your entry later on, and discovered I hadn't added the --debug argument. Here's the log once I ran your command with --debug included:

$ /usr/bin/borg init --info --log-json --encryption=repokey-blake2 ssh://[reponame]@[reponame].repo.borgbase.com/./repo --debug
{"type": "log_message", "time": 1735608186.2327075, "message": "using builtin fallback logging configuration", "levelname": "DEBUG", "name": "borg.logger"}
{"type": "log_message", "time": 1735608186.2876413, "message": "33 self tests completed in 0.05 seconds", "levelname": "DEBUG", "name": "borg.archiver"}
{"type": "log_message", "time": 1735608186.293018, "message": "SSH command line: ['ssh', '[reponame]@[reponame].repo.borgbase.com', 'borg', 'serve', '--debug']", "levelname": "DEBUG", "name": "borg.remote"}
{"type": "log_message", "time": 1735608187.395187, "message": "Remote: [reponame]@[reponame].repo.borgbase.com: Permission denied (publickey,gssapi-keyex,gssapi-with-mic).", "levelname": "WARNING", "name": "root"}
{"type": "log_message", "time": 1735608187.400813, "message": "Connection closed by remote host. Is borg working on the server?", "levelname": "ERROR", "name": "borg.archiver", "msgid": "ConnectionClosedWithHint"}
{"type": "log_message", "time": 1735608187.400948, "message": "Traceback (most recent call last):\n  File \"/usr/lib/python3.13/site-packages/borg/archiver.py\", line 5391, in main\n    exit_code = archiver.run(args)\n  File \"/usr/lib/python3.13/site-packages/borg/archiver.py\", line 5309, in run\n    rc = func(args)\n  File \"/usr/lib/python3.13/site-packages/borg/archiver.py\", line 169, in wrapper\n    repository = RemoteRepository(location.omit_archive(), create=create, exclusive=argument(args, exclusive),\n                                  lock_wait=self.lock_wait, lock=lock, append_only=append_only,\n                                  make_parent_dirs=make_parent_dirs, args=args)\n  File \"/usr/lib/python3.13/site-packages/borg/remote.py\", line 594, in __init__\n    raise ConnectionClosedWithHint('Is borg working on the server?') from None\nborg.remote.ConnectionClosedWithHint: Connection closed by remote host. Is borg working on the server?\n\nPlatform: Linux Plasmattitude5420 6.12.7-arch1-1 #1 SMP PREEMPT_DYNAMIC Fri, 27 Dec 2024 14:24:37 +0000 x86_64\nLinux: Unknown Linux  \nBorg: 1.4.0  Python: CPython 3.13.1 msgpack: 1.0.5 fuse: pyfuse3 3.4.0 [pyfuse3,llfuse]\nPID: 3612  CWD: /home/juanejot\nsys.argv: ['/usr/bin/borg', 'init', '--info', '--log-json', '--encryption=repokey-blake2', 'ssh://[reponame]@[reponame].repo.borgbase.com/./repo', '--debug']\nSSH_ORIGINAL_COMMAND: None\n", "levelname": "DEBUG", "name": "borg.archiver"}

[m3nu]

Good news then. SSH and Borg are both working.

Your second command fails, since the repo is already initialized.

Maybe you have the same issue with Vorta? Trying to add a repo as "new" that's already initialized? (had run borg init on it).

[juanejot]

Thank you for your continued interest in resolving this issue. Unfortunately, this is the output of invoking vorta from the command line (See $ vorta command at top, and the jobs_manager info at the bottom that I was quitting the app), and attempting to add the repo as an existing one. It may be due to a different issue I hope you can help me find, but it doesn't work either. You'll see it correctly retrieves the passphrases for both the local repo and for the borgbase remote repo, and then… Permission is denied.

This same passphrase still works manually via ssh* in the CLI, so it's not the password that's wrong. I just don't see in this log, what is wrong.

*Note: I didn't just call the keys "id_ed25519" and "id_ed25519.pub," because I have other uses for SSH on my system. So I did follow Support's suggestion of entering $ eval $(ssh-agent), got a process number (so it was running), then $ ssh-add ~./ssh/whatIwantocallit_id_ed25519, THEN entered $ ssh -v [reponame]@[reponame}.repo.borgbase.com and got a successful connection.
Of note, this ssh key addition is non-persistent across login sessions. Nevertheless, I get the same output as below, whether I have added the ssh key or not… but then I suppose I've only added the ssh key to that terminal session, huh… not necessarily to anything that Vorta (as a process) can see? What key (and "password," as listed below) is it using to try to connect to the remote repo, then? Is it not using a .pub key at all, just sending a "password," and that's why it's failing?

$ vorta
2024-12-31 18:38:42,456 - vorta.i18n - DEBUG - Loading translation succeeded for ['en-Latn-US', 'en-US', 'en'].
2024-12-31 18:38:42,497 - vorta.views.source_tab - DEBUG - Added item number 0 from 1
2024-12-31 18:38:42,570 - root - INFO - Using NetworkManagerMonitor NetworkStatusMonitor implementation.
2024-12-31 18:38:42,583 - vorta.scheduler - DEBUG - Nothing scheduled for profile 2 because of unset repo.
2024-12-31 18:38:42,586 - vorta.scheduler - DEBUG - Nothing scheduled for profile 2 because of unset repo.
2024-12-31 18:38:42,589 - vorta.scheduler - DEBUG - Nothing scheduled for profile 2 because of unset repo.
2024-12-31 18:38:42,609 - vorta.borg.jobs_manager - DEBUG - Add job for site default
2024-12-31 18:38:42,610 - vorta.borg.jobs_manager - DEBUG - Start job on site: default
2024-12-31 18:38:42,611 - vorta.borg.borg_job - INFO - Running command /usr/bin/borg --version
2024-12-31 18:38:42,946 - vorta.borg.jobs_manager - DEBUG - Finish job for site: default
2024-12-31 18:38:42,946 - vorta.borg.jobs_manager - DEBUG - No more jobs for site: default
2024-12-31 18:38:42,947 - vorta.scheduler - DEBUG - Refreshing all scheduler timers
2024-12-31 18:38:42,950 - vorta.scheduler - INFO - Setting timer for profile 1
2024-12-31 18:38:42,952 - vorta.scheduler - DEBUG - Catching up by running job for Default (1)
2024-12-31 18:38:42,955 - vorta.scheduler - INFO - Starting background backup for Default
2024-12-31 18:38:42,956 - vorta.notifications - DEBUG - success notifications suppressed
2024-12-31 18:38:42,961 - vorta.keyring.abc - DEBUG - No module named 'objc'
2024-12-31 18:38:43,002 - vorta.keyring.abc - DEBUG - Using VortaKWallet5Keyring
2024-12-31 18:38:43,002 - vorta.borg.borg_job - DEBUG - Using VortaKWallet5Keyring keyring to store passwords.
2024-12-31 18:38:43,004 - vorta.keyring.kwallet - DEBUG - Retrieved password for repo /run/media/juanejot/LinUxSBackups/pika-lappy
2024-12-31 18:38:43,006 - vorta.scheduler - ERROR - Conditions for backup not met. Aborting.
2024-12-31 18:38:43,006 - vorta.scheduler - ERROR - Repo folder not mounted or moved.
2024-12-31 18:38:43,006 - vorta.notifications - DEBUG - notification not suppressed
2024-12-31 18:38:43,018 - vorta.scheduler - DEBUG - Paused 1 until 2024-12-31 19:38:43
2024-12-31 18:38:43,019 - vorta.scheduler - DEBUG - Nothing scheduled for profile 2 because of unset repo.
2024-12-31 18:38:49,814 - vorta.keyring.abc - DEBUG - No module named 'objc'
2024-12-31 18:38:49,816 - vorta.keyring.abc - DEBUG - Using VortaKWallet5Keyring
2024-12-31 18:38:49,819 - vorta.keyring.kwallet - DEBUG - Retrieved password for repo ssh://[reponame]@[reponame].repo.borgbase.com/./repo
2024-12-31 18:38:57,503 - vorta.keyring.abc - DEBUG - No module named 'objc'
2024-12-31 18:38:57,504 - vorta.keyring.abc - DEBUG - Using VortaKWallet5Keyring
2024-12-31 18:38:57,504 - vorta.borg.borg_job - DEBUG - Using VortaKWallet5Keyring keyring to store passwords.
2024-12-31 18:38:57,508 - vorta.keyring.kwallet - DEBUG - Retrieved password for repo ssh://[reponame]@[reponame].repo.borgbase.com/./repo
2024-12-31 18:38:57,518 - vorta.borg.borg_job - INFO - Running command /usr/bin/borg info --info --json --log-json ssh://[reponame]@[reponame].repo.borgbase.com/./repo
2024-12-31 18:38:59,007 - vorta.borg.borg_job - WARNING - Remote: [reponame]@[reponame].repo.borgbase.com: Permission denied (publickey,gssapi-keyex,gssapi-with-mic).
2024-12-31 18:38:59,012 - vorta.borg.borg_job - ERROR - Connection closed by remote host. Is borg working on the server?
2024-12-31 18:39:13,267 - vorta.borg.borg_job - DEBUG - Cancel job on site default
2024-12-31 18:39:13,268 - vorta.borg.jobs_manager - INFO - Finished cancelling all jobs

[juanejot]

This issue remains unresolved, and I may have to back off of using BorgBase, as I'm currently also having trouble setting up a new backup via GNOME/Pika Backup (giving the same error messages that KDE Plasma/Vorta is having); I've been through all the BorgBase Setup steps & documentation; it's just not working for me.

[m3nu]

Vorta will work with any SSH-based storage. It doesn't need to be borgbase. If you have your own SSH server, you can use that for testing too.

Above I meant to use the borg command directly. I.e. the command it shows in your log. You may see additional logs with that.

... Running command /usr/bin/borg info --info --json --log-json ssh://[reponame]@[reponame].repo.borgbase.com/./repo

[quazgar]

I had the same problem: Connecting to a server does not work with a new SSH key.

Description of problem

When adding a new repo to a profile, I can select the correct ssh key:

But after the repo is created, the key does not show up any more:

A brief glance into the setting confirms that the ssh key is not stored:

Workaround

Setting the ssh key manually works for me: In "Extra Borg Arguments", set --rsh="ssh -i ~/.ssh/id_rsa_backup"

[lg2it]

I have same problem, cannot figure it out.

[m3nu]

Unfortunately this error message can mean a lot of things. This troubleshooting guide for borgbase.com users may help, but might need slight adjustment with other remotes:

https://docs.borgbase.com/faq/#all-connections-to-a-borgbase-repo-fail-with-an-error-immediately

[m3nu]

Remote: [reponame]@[reponame].repo.borgbase.com: Permission denied (publickey,gssapi-keyex,gssapi-with-mic).

This log message points to a key mismatch. (item 1 in the FAQ)

[quazgar]

Remote: [reponame]@[reponame].repo.borgbase.com: Permission denied (publickey,gssapi-keyex,gssapi-with-mic).

This log message points to a key mismatch. (item 1 in the FAQ)

Do I understand the FAQ correctly, that it is not possible in Vorta to select a specific key? Then I misunderstood the GUI.

I normally have an SSH key that requires a password, but for the backup on our company server, I generated a passwordless ssh key, which has access to a very restricted account only. So also on the commandline I have to specify the key explicitly, either with --rsh=... or by setting the BORG_RSH environment variable.

I was under the impression that the GUI lets one choose a specific SSH key to handle this use case.

[m3nu]

Do I understand the FAQ correctly, that it is not possible in Vorta to select a specific key? Then I misunderstood the GUI.

Where does it say that? The FAQ isn't Vorta specific. It's to debug SSH in general. Vorta also uses SSH and does list and allow to select a specific key.

[quazgar]

Vorta also uses SSH and does list and allow to select a specific key.

That's what I showed here, that it does not seem to store the key settings. And it may also be what the OP reported: they named their key ~/.ssh/newkey_id_ed25519, and that key never showed up in their logs.