Resolved Backup fails since update to Plesk Obsidian 18.0.26: "Unable to validate the remote backup"

[hansitheking]

For me the update to 18.0.27 fixed the issue but backups are also working without "fftpMaxTlsVersion = 12". Thank you @DenisG

I did the update to 18.0.27 yesterday and added the "fftpMaxTlsVersion = 12" to my panel.ini, therefore I didn´t had the error tonight.

[pmm]
ftpForbidReuseConnection = 1
ftpMaxTlsVersion = 12

This night I will test it without "ftpMaxTlsVersion = 12" to see what happens.

 

[DenisG]

I did not have ftpForbidReuseConnection = 1, it wasn't introduced to fix it, is it required?

No, it is not.

 

[D3nnis3n]

Well, then the issue is persistent for me. Probably rebooting the whole server after a few hundred days of uptime and seeing if it works after that.

 

[D3nnis3n]

That indeed worked, weird, i had restarted Plesk after the changes.

 

[obendev]

I still have this issue.

[pmm]
ftpMaxTlsVersion = 12

Didn't work for me.
I get this error in my mail logs, and the "Unable to extract dump header" in Plesk.

Unable to get ftp dumps list: pmm-ras failed (Error code = 1): Repository error: Failed to read backup example.tar: Import error: Unable to find archive metadata. The archive is not valid Plesk backup or has been created in an unsupported Plesk version

Plesk Obsidian v18.0.27_build1800200508.17 os_Ubuntu 18.04
Plesk Migrator 2.19.4-921, so it should be fixed

 

[King555]

After hours of googling I finally found users with the same problem.

I create daily automated backups to Strato HiDrive, one via Plesk and several via a cronjob on my server, which uploads with a curl command.

Since several days or weeks I always got this error from Plesk:
pmm-ras failed (Error code = 1): Repository error: Failed to read backup backup_2003160309.tar: Import error: Unable to find archive metadata. The archive is not valid Plesk backup or has been created in an unsupported Plesk version

Today I found out that not a single backup was uploaded correctly. Neither via Plesk, nor via my script for curl. Even manual uploads via console are incomplete (and have a different size with every upload).

I just did a verbose output of curl and it said (multiple times):
TLSv1.3 (OUT), TLS Unknown, Unknown (23)

If I understood correctly, both Strato HiDrive and Hetzner Storage Box (which I wanted to try now) don't support modern encryption, which curl uses by default.

EDIT: Today I made several tests. Concerning STRATO HiDrive I found out that using curl with --tlsv1.2 is neccessary. Only then the files are complete. If I use only --tls-max 1.2 (which should be enough), it does not work, because TLS 1.3 is still used. To make it even more safe, I use now --tlsv1.2 --tls-max 1.2.

Concerning Hetzner Storage Box it seems that TLS 1.3 ist not supported at all, only 1.2 (and maybe lower). Did they recently deactivate 1.3, because it was broken? When I do not specify the TLS version, 1.2 is used. If I force 1.3, I get an error and no upload is done at all. I did not get an error message from the Plesk backup of last night, but the remote backup has another file size than the local backup. Or is this correct? The remote file is larger.

 

[DenisG]

I did not get an error message from the Plesk backup of last night, but the remote backup has another file size than the local backup. Or is this correct? The remote file is larger.

This is correct, remote backups are larger because they contains additional metadata (signs, headers, indexes ...).

 

[King555]

@DenisG Thanks, then I guess the files are OK now.

Btw: I got a reply from Hetzner concerning TLS 1.3 and their Storage Box (I asked them whether they do not support 1.3). They said there was a bug and they had to disable 1.3 (they try to fix it). So if someone of you suddenly has no more problems with the FTP backup on the Hetzner storage even without ftpMaxTlsVersion = 12, then it's because curl does not try to use 1.3 now (it's not offered by the server anymore). But for Strato HiDrive the new option is still required (set to 12)!

We have added option to /usr/local/psa/admin/conf/panel.ini to limit maximum TLS version
The option will be available since Plesk 18.0.27

Will this new option also appear in the extension "Panel.ini Editor"? Or does this extension don't offer all possible settings anyway?

 

[obendev]

Will this new option also appear in the extension "Panel.ini Editor"? Or does this extension don't offer all possible settings anyway?

@King555 I think there is a Bug with the Panel.ini Editor extension, see Forwarded to devs - ftpMaxTlsVersion option isn't listed in Panel.ini Editor extension

 

[King555]

Oh, I did not see that report, thanks for the information.

 

[obendev]

Will this new option also appear in the extension "Panel.ini Editor"? Or does this extension don't offer all possible settings anyway?

It's a confirmed bug PPPM-11986 now

What is weird though, I still get the error, even with the option. But it seems like, Backups get uploaded.
Hopefully Hetzner will fix TLS 1.3 asap.

 

[obendev]

Hetzner will update the TLS 1.3 bug on July 1, 2020

 

[King555]

STRATO told me that their HiDrive does support TLS 1.3 and there are no problems. Then it's only me (and I remember there was one user in this thread with the same problem).

 

[obendev]

The TLS 1.3 with Hetzner is fixed, however we still get the following error:

pmm-ras failed (Error code = 1): Repository error: Failed to read backup backup_test.de_2006230021.tar: Import error: Unable to find archive metadata. The archive is not valid Plesk backup or has been created in an unsupported Plesk version

In Plesk ("View Log"):

Unable to validate the remote backup. It may not be restored. Error: Failed to exec pmm-ras: Exit code: 119: Import error: Unable to find archive metadata. The archive is not valid Plesk backup or has been created in an unsupported Plesk version

 

[King555]

When I run this command:
curl -v -s --user xxxxxx:yyyyyyy --ftp-ssl --tlsv1.3 --disable-epsv ftp://xxxxxx.your-storagebox.de/ -l

I get a lot of lines like this:
TLSv1.3 (IN), TLS Unknown, Unknown (21):

To me it looks like Hetzner did not resolve the problem.

Using tlsv1.2 does not show lines like this.

 

[DenisG]

The TLS 1.3 with Hetzner is fixed, however we still get the following error

Try to use 18.0.28.2. Also we will have one more fix PPPM-12084 and updated libcurl version in 18.0.29.

 

[obendev]

The issue is finally fixed for me, after updating to Plesk Obsidian 18.0.28 Update 2 (Change Log for Plesk Obsidian).
I have no settings in my panel.ini related to backups or FTP connections and I removed any .ftpaccess files from my Hetzner Storage Box (FTP Server).
Prior settings in the .ftpaccess file:

AllowRetrieveRestart on
AllowStoreRestart on

Passive mode and FTPS are enabled in the Backup Manager settings.

 

[itoop]

I also still get the error

Unable to validate the remote backup. It may not be restored. Error: Failed to exec pmm-ras: Exit code: 119: Import error: Unable to find archive metadata. The archive is not valid Plesk backup or has been created in an unsupported Plesk version

in Plesk Obsidian Version 18.0.28 Update #2 again, so the problem is not fixed.

 

[DenisG]

If you have only an error like

Unable to validate the remote backup. It may not be restored. Error: Failed to exec pmm-ras: Exit code: 119: Import error: Unable to find archive metadata. The archive is not valid Plesk backup or has been created in an unsupported Plesk version

try to increase the value of the option in panel.ini

[pmm]
archiveMetaReadBlockSize = 10

10 MB is default value.

 

[obendev]

Can you provide more information?

• Have you made any changes to the panel.ini according backups?
• What FTP-Server type do you use for your backups? (Ask your hoster)
  • What settings are applied to the FTP-Server, for example
    • AllowRetrieveRestart
    • AllowStoreRestart
• Are there .ftpaccess files on your FTP Server?
• Do you use FTPS? (Backup Manager > Remote Storage Settings > FTP(S) Storage Settings)
• Do you passive mode? (Backup Manager > Remote Storage Settings > FTP(S) Storage Settings)
• What Plesk version do you use? With build number and OS. (Tools & Settings > Server Information)