VCF 9.1 SFTP Backup fails with "Invalid parameter: Server host key validation failed" on non-standard ports

Products

• VCF Operations

Issue/Introduction

When attempting to configure a remote SFTP backup location in VMware Cloud Foundation (VCF) 9.1, the configuration task fails if a non-standard SSH port (any port other than 22) is specified.

Symptoms:

• Users are unable to save SFTP backup settings in the SDDC Manager UI.
• Manual ssh-keyscan from the SDDC Manager appliance successfully retrieves the server fingerprint, but the UI validation fails.
• The following error message is displayed in the UI: Invalid parameter: Server host key validation failed for <SFTP_SERVER_FQDN>. Ensure that the server is configured to support either the ssh-rsa or ecdsa host key algorithms.

Log Analysis: The /var/log/vmware/vcf/operationsmanager/operationsmanager.log file contains entries similar to:

ERROR [operations-manager] SSH connection failed with exit code 255: Server key did not validate.

Environment

• Product: VMware Cloud Foundation (VCF) 9.1.0.0
• Component: SDDC Manager / VCF Operations (Build - VCF Management)
• Configuration: Remote SFTP Backup target utilizing a custom port (e.g., 2222).

Cause

Internal keyscan mechanism used by VCF 9.1 to populate the in-memory host key repository continues to provide bare hostnames without port identifiers. This discrepancy results in a format mismatch during the validation phase, causing the system to reject valid host keys for any port other than the default (Port 22).

Resolution

This issue is resolved in VMware Cloud Foundation later releases.

To resolve the issue:

1. Plan and execute an upgrade of the VCF management components to version higher than build 9.1.0.0.
2. Once the upgrade is complete, re-attempt the SFTP backup configuration using the custom port.

Workaround

If an upgrade to higher than VCF 9.1.0.0 is not immediately possible, use the following steps to unblock backup operations:

1. Log in to the SDDC Manager UI.
2. Navigate to Administration > SDDC Manager > Backup Settings.
3. Configure the Backup Location to a local directory or a temporary mount point on the SDDC Manager appliance that does not require this network validation logic.
4. Alternatively, temporarily reconfigure the SFTP server to listen on the standard Port 22 if the environment allows.