Error 29117: NSX Manager SFTP backup hangs or fails

Products

• VMware NSX

Issue/Introduction

When configuring or updating the SFTP server settings for NSX Manager Backups using SSH Private Key authentication (System > Backup & Restore > Backup Configuration):

1. Clicking Save causes the UI modal to hang indefinitely with a spinning loading indicator.

2. After a timeout or browser refresh, saving the configuration results in the following error:

   

    

   Error: Backup error: Authentication failed on fileserver sftp://<sftp-server-fqdn>:22/path/to/backup/. 
   Either private key is not valid or public key is not configured on fileserver. (Error code: 29117)
   

3. In some instances, the Backup History table under System > Backup & Restore remains empty or fails to populate previous backup entries.

 

Environment

 

• VMware NSX 4.x

• VMware NSX-T Data Center 3.x

 

Cause

This issue occurs due to one or more of the following conditions:

1. Incompatible Key Format: NSX requires Legacy PEM (PKCS#1) RSA keys. OpenSSH formatted keys (-----BEGIN OPENSSH PRIVATE KEY-----) are not supported.
2. Passphrase Encryption: The private key is encrypted (header contains Proc-Type: 4,ENCRYPTED). NSX non-interactive backup jobs cannot process passphrase-protected keys, causing the connection worker to hang.
3. Permissions: The SFTP user's ~/.ssh directory or authorized_keys file has permissions that are too open, failing SSH StrictModes.

Resolution

To resolve this issue, generate a new unencrypted Legacy RSA key pair.

1. Log into the SFTP server as the backup user #### and run the below commands .
2. Generate a new Legacy RSA key with no passphrase:
    

   ssh-keygen -t rsa -b 2048 -m PEM -N "" -f ~/.ssh/nsx_backup_key

3. Authorize the public key and set strict permissions or Append the newly generated public key to authorized_keys and set strict file permissions
    

   cat ~/.ssh/nsx_backup_key.pub >> ~/.ssh/authorized_keys
chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys
    
4. Verify the private key header starts with -----BEGIN RSA PRIVATE KEY----- and lacks ENCRYPTED lines:
    

   cat ~/.ssh/nsx_backup_key

5. Perform a hard refresh (Ctrl+F5) in the NSX UI.
6. Navigate to System > Backup & Restore > Edit SFTP Configuration.
7. Select SSH Private Key, paste the new key, and clear the SSH Fingerprint field for auto-detection.
8. Re-enter the Passphrase and Confirm Passphrase (for NSX backup data encryption
9. Click Save.
10. After the successful configuration, test the backup restore.

Additional Information

• For instructions on downloading NSX releases, see Download Broadcom Products and Software.
• To speak with a customer representative or a Support Engineer, see Contact Broadcom Support.