0

I'm running an SFTP server using openssh 1:8.9p1-3ubuntu0.1 on Ubuntu 22.04. A reoccurring issue with connecting clients is the username is prefixed with \357\273\277 one or more times. This is a UTF-8 BOM mark which is not needed and this login attempt fails because the username does not exist as prefixed with a BOM.

I currently work with each client to fix their connection. The one thing that seems to be in common is they are on Windows and use the Sticky Notes app to store their SFTP credentials so possibly that app is what adds the BOM. They are probably all using WinSCP which has some BOM settings, but those seem to be specific to the files that WinSCP transfers.

Is there a way to have openssh or PAM strip the leading BOM(s)?

If it's specific to WinSCP, is there some setting the clients should configure?

Thanks

Relevant /var/log/auth.log entry

Aug 28 16:13:25 sftp1 sshd[1670168]: Failed password for invalid user \357\273\277\357\273\277redacted_sftp_username from 165.165.165.165 port 35970 ssh2

Linux version

sftp1:~# lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description:    Ubuntu 22.04.3 LTS
Release:        22.04
Codename:       jammy

Openssh Version

sftp1:~# dpkg -l | grep openssh
ii  openssh-client                     1:8.9p1-3ubuntu0.1                      amd64        secure shell (SSH) client, for secure access to remote machines
ii  openssh-server                     1:8.9p1-3ubuntu0.1                      amd64        secure shell (SSH) server, for secure access from remote machines
ii  openssh-sftp-server                1:8.9p1-3ubuntu0.1                      amd64        secure shell (SSH) sftp server module, for SFTP access from remote machines

System Locale

sftp1:~# locale
LANG=C.UTF-8
LANGUAGE=
LC_CTYPE="C.UTF-8"
LC_NUMERIC="C.UTF-8"
LC_TIME="C.UTF-8"
LC_COLLATE="C.UTF-8"
LC_MONETARY="C.UTF-8"
LC_MESSAGES="C.UTF-8"
LC_PAPER="C.UTF-8"
LC_NAME="C.UTF-8"
LC_ADDRESS="C.UTF-8"
LC_TELEPHONE="C.UTF-8"
LC_MEASUREMENT="C.UTF-8"
LC_IDENTIFICATION="C.UTF-8"
LC_ALL=
kmiller
  • 1
  • 1
  • 1
    Could they store the credentials in WinSCP itself instead?... – u1686_grawity Aug 28 '23 at 20:25
  • They are based on what I've seen in screen sharing sessions with a few. They are copying the username and pasting it into the WinSCP GUI. The username looks normal on their side. But on the server side, I can see the BOM mark being sent. We can fix it by clicking after the first letter of the username, for example 'a', pressing backspace multiple times and then typing in 'a' – kmiller Aug 28 '23 at 20:30
  • I don't have any control of the clients, only the sftp server. The BOM issue happens frequently enough that I was hoping to handle it server side if possible. – kmiller Aug 28 '23 at 21:03

0 Answers0