VCSA SFTP backups fail - "Failure establishing ssh session: -43, Failed getting banner"

Products

• VMware vCenter Server

Issue/Introduction

• When attempting to backup a VCSA via VAMI to an SFTP server, we get error : "General system error reported by backup server".
  
  
• Log snippet seen in the /var/log/vmware/applmgmt/backup.log file:

XXXX-XX-XXTXX:XX:XX.XXX [20250210-220146-24322018] [MainProcess:PID-5670] [SftpStorageIOLib::_authorizeLocalHost:SftpStorageIOLib.py:174] ERROR: Failed to authorize local host with command: sshpass -f /tmp/tmpxzwgwiu1 ssh-copy-id -i /root/.ssh/id_rsa.pub -p 22 -o UserKnownHostsFile=/root/.ssh/br_temp_known_hosts user@server-ip. Will proceed with backup through curl
XXXX-XX-XXTXX:XX:XX.XXX [20250210-220146-24322018] [MainProcess:PID-5670] [SftpStorageIOLib::_readRemoteRoot:SftpStorageIOLib.py:145] INFO: Executing command to get remote root: ssh -q -p 22 -i /root/.ssh/id_rsa -o UserKnownHostsFile=/root/.ssh/br_temp_known_hosts 'user@server-ip' echo ~
XXXX-XX-XXTXX:XX:XX.XXX [20250210-220146-24322018] [MainProcess:PID-5670] [FtpStorageIOLib::_process_curl_output:FtpStorageIOLib.py:133] ERROR: sftp cmd failed. RC: 2, Err: curl: (2) Failure establishing ssh session: -43, Failed getting banner
, Cmd: ['/usr/bin/curl', '--fail', '-u', 'backup-user:****', '--connect-timeout', '120', '--ssl-reqd', '-k', '--noproxy', '*', '--silent', '--show-error', '--list-only', 'sftp://server-ip:22/folder/sms/vCenter/vCenter/VCSA-FQDN/M_7.0.3.02200_20250210-220146_/']
XXXX-XX-XXTXX:XX:XX.XXX [20250210-220146-24322018] [MainProcess:PID-5670] [BackupManager::CreateTargetBackupDir:BackupManager.py:111] ERROR: Failed to create backup directory Plugin error occurred. ErrCode: 5, Args: ()
XXXX-XX-XXTXX:XX:XX.XXX [20250210-220146-24322018] [MainProcess:PID-5670] [BackupManager::main:BackupManager.py:592] ERROR: BackupManager encountered an exception: Failed to create backup directory on backup server.

Environment

vCenter Server 7.x
vCenter Server 8.x

Cause

This is caused by a negotiation issue between the vCenter Server and targeted SFTP server. This could be due to a firewall issue or an SFTP server configuration issue.

Resolution

Enabled "allow non-RFC compliant SSH protocol version exchange" on the targeted SFTP server.  Please refer to the relevant OS vendor documentation for implementing any configuration changes.  

Ensure any firewall in-between is configured to allow SSH connectivity from the VCSA to the targeted SFTP server.  Please refer to the relevant firewall vendor documentation for implementing any configuration changes.

Additional Information

Review proxy settings on the vCenter.
If FTP is not in use then disable FTP in the proxy setting of the vCenter by editing the /etc/sysconfig/proxy and adding "" in place of FTP proxy configured.

# Example: VCENTER_PROXY="http://proxy.provider.xy:3128/"
VCENTER_PROXY=""