SFTP module Connection Timeout in Quality Environment

0
I'm facing an issue with the Mendix SFTP module and looking for some guidance.We have an SFTP configuration that was working earlier in our Quality environment. Recently, when I try to click "Obtain Host Key", I get the following error: java.net.SocketTimeoutException: Connect timed outA few observations:This setup was working before without any changes from our side.The issue is happening only in the Quality environment.When I use port 8022, obtaining the host key times out.If I switch to port 22, I am able to retrieve the host key, but the actual SFTP connection/authentication does not work.The error occurs while executing the "Get Host Key" action.Has anyone faced a similar issue before?I'm trying to understand whether this points to:A firewall/network issue on port 8022,A change on the SFTP server side,Or something specific to the Mendix SFTP module.Any suggestions on what to check next would be really helpful.Thanks in advance!
asked
2 answers
0

Hi,

The Connect timed out error means the connection to the server isn't established at all. So I would say this is a network/firewall issue and not something related to the SFTP module.

About port 22: you are most probably connecting to a different SSH service on the same server, not the SFTP one. That's why you get a host key but the authentication fails. I would keep 8022 as the port.

What I would check first:

  1. IP whitelisting. Ask the SFTP server admin if something changed on their firewall, and make sure the outgoing IP of your Quality environment is still whitelisted for port 8022.
  2. Other environments. Does the same setup still work in Test or Production? If yes, compare their outgoing IPs with Quality. This usually points directly to the problem.
  3. Test outside Mendix. If possible, test the connection to the host on port 8022 from the same network (e.g. Test-NetConnection <host> -Port 8022). If it times out there too, it confirms it's a network issue.

Once port 8022 is reachable again, click Obtain host key again to get the correct key, and the connection should work.

Hope this helps!
Fjordi

answered
0

Hi Gopinath,


Based on the error, I would first investigate this as a network connectivity issue rather than an SFTP module issue.


The important part is:

java.net.SocketTimeoutException: Connect timed out

This means the Mendix runtime was unable to establish the TCP connection to the configured SFTP host/port within the configured timeout. The connection is therefore failing before SFTP authentication or host-key verification takes place.


The fact that Obtain Host Key also fails supports this, because the application first needs to establish a connection to the SFTP server before it can retrieve the server's host key.


Since this worked previously and there were no application changes, I would check connectivity from the Quality environment itself, not from a developer laptop.


In particular, verify:

  • The configured SFTP hostname still resolves to the expected IP address.
  • Outbound TCP traffic from the Quality environment to the SFTP server on port 22 is allowed.
  • The SFTP server/firewall still allows the outbound/public IP address of the Quality environment.
  • There has been no firewall, routing, proxy, VPN, DNS, NAT or IP-whitelisting change.
  • The SFTP service is actually listening on port 22 and is reachable from the Quality environment/network.

If you have access to the infrastructure hosting the Mendix runtime, a simple connectivity test from that network is useful:

nc -vz <sftp-host> 22

or:

telnet <sftp-host> 22

If that also times out, changing anything in the SFTP module will not solve the issue; the network path/firewall needs to be fixed first.


I also would not change the SFTP port just as a test unless the SFTP server is actually configured to listen on that port. No route to host on another port does not indicate an SFTP configuration problem; it is another network-level failure.


Once port 22 connectivity is restored, try Obtain Host Key again. If the connection succeeds but the host key has changed, then verify the new fingerprint with the SFTP administrator before updating it, especially since Strict hostkey checking is enabled.


Increasing the Connect timeout may help only when the network is slow. It will not fix a blocked port, incorrect route, DNS problem, or IP-whitelisting issue.

So my first check would be:

Quality Runtime
      ↓
DNS resolution
      ↓
TCP connectivity to SFTP host:22
      ↓
Firewall / IP whitelist
      ↓
SSH/SFTP handshake
      ↓
Host key verification
      ↓
Authentication

Given that this stopped working without an application change, I would specifically ask the infrastructure/SFTP team whether the Quality environment's outbound IP, firewall rules, or SFTP server allowlist changed recently.


Hope this helps.

answered