vCenter Server 9.1 SFTP Backup Failures: Unable to Establish SSH Session

Products

• VMware vCenter Server

Issue/Introduction

After upgrading to VMware vCenter Server 9.1, scheduled SFTP file-based backups fail via the vCenter Server Management (VAMI) interface.

The task fails with the following error message:

"Unable to establish ssh session. Please check the key exchange algorithms in VC and backup server."

This behavior occurs because vCenter Server 9.1 mandates stricter cryptographic standards for automated SSH tunnel establishment. If the remote SFTP backup server is configured with incompatible host key algorithms or key exchange (KEX) methods, the automated backup plugin will reject the connection, often resulting in returncode=255 or ErrCode: 201.

Environment

Product: VMware vCenter Server
Version: 9.1
Component: vCenter Server Management (VAMI)

Cause

vCenter Server 9.1 introduces stricter SSH security policies. Automated backups now require modern Key Exchange (KEX) algorithms and host key types. A common failure occurs when the backup server lists certificate-wrapped host key algorithms (e.g., [email protected]) in its sshd_config without providing the corresponding raw key algorithm (ecdsa-sha2-nistp256).

If the plain ECDSA algorithm is absent, the negotiation may fall back to RSA, which may fail the specific security handshake requirements for vCenter 9.1, leading to an SSH session failure.

Resolution

Prerequisites

• Take a snapshot or backup of the vCenter Server Appliance.
• Ensure you have root-level access to the SFTP backup server.

Part 1: Update Backup Server SSH Configuration (Recommended)
To resolve the cryptographic mismatch, you must ensure the backup server advertises the raw ECDSA host key algorithm correctly.

1. Log in to the SFTP backup server.
2. Edit the SSH daemon configuration file (typically /etc/ssh/sshd_config).
3. Update (or add) the HostKeyAlgorithms line to include the plain ECDSA key. Ensure it does not rely solely on certificate-variant algorithms:
   HostKeyAlgorithms ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-ed25519

Note: Ensure ecdsa-sha2-nistp256 is included as a raw key algorithm. The certificate-variant [email protected] is a no-op if the server lacks an SSH certificate wrapper.
4. Restart the SSH service on the backup server to apply the changes:
   systemctl restart sshd

Part 2: Client-Side Configuration (Optional Workaround)
If updating the backup server is not immediately possible, you may disable the automated SSH tunnel creation on the vCenter appliance. This forces the backup plugin to use a standard direct curl connection.

1. Log in to the vCenter Server Appliance using SSH as root.
2. Update the configuration file to disable the tunnel:
   echo "$(jq '.backupRestore.skipSshTunnel=true' /etc/applmgmt/appliance/appliance.conf )" > /etc/applmgmt/appliance/appliance.conf

3. Restart the management service:
   service-control --restart applmgmt

Part 3: Verify Proxy Exclusions
If a global proxy is configured in VAMI, the backup server must be bypassed to prevent handshake interception.

1. In the VAMI UI (https://<vcenter_fqdn>:5480), go to Networking > Proxy.
2. Add the backup server's IP address and FQDN to the No Proxy list.
3. Save the changes.

Additional Information

Verification: After updating the sshd_config on the backup server, verify the configuration by attempting an SSH connection from the vCenter appliance to the backup server via the backup port (e.g., ssh -vvv backupuser@<backup_server_ip> -p 22).
Logs: Review /var/log/vmware/applmgmt/backupValidate.log for specific ErrCode: 201 entries.