Troubleshooting

Gather details first

• The connection log. A terminal’s ⋯ › Connection log shows each step of a connection: the address dialled, each jump host, the host key, the login methods tried and the server’s answers.
• The app log. Settings › About › Open log folder opens sternway.log (up to 5 files of 1 MB). It records what the app did and what went wrong, never passwords, keys, what you typed or what a terminal showed. On the phone the log stays in the app.
• Diagnostics. Settings › About › Copy diagnostics puts the version, platform and your settings (without their secrets) on the clipboard as text for a bug report. Nothing is sent anywhere.

The app does not start

Linux AppImage stops with dlopen(): error loading libfuse.so.2. Install FUSE 2 (sudo apt install libfuse2t64, or libfuse2 on Ubuntu 22.04 and Debian), or run ./Sternway-*.AppImage --appimage-extract-and-run.

Linux asks to “Create a passphrase”. No system keychain (Secret Service) was found, so Sternway protects its data with a passphrase instead. Choose one; you type it at each start. Installing and unlocking GNOME Keyring or KWallet before the first start avoids it.

Windows SmartScreen blocks the installer. The app is not code-signed yet. Choose More info, then Run anyway.

“Sternway could not open your data”. The data on the device did not open: the database may be damaged, the system’s key store may have refused its key, or the disk may be full. Nothing was changed. Choose Try again first. Start with empty data moves the data that did not open into a new folder beside it (named “unopened” and the date) without deleting anything, and starts with nothing; the screen says where it went so it can be put back.

A host does not connect

“Host key changed for …”. The server presented a different key from the one saved for it. Someone may be intercepting the connection, or the server was reinstalled. Check with the server’s administrator; choose Replace key only if you know the server’s key changed.

The login is refused. Check the user name and password or key in the host’s editor, and the connection log for which methods were tried. With an SSH agent holding many keys, the server may refuse after too many: give the host its own key (Use an SSH agent).

An unknown host key is refused without asking. Settings › Connections & SSH › Unknown host keys is set to Strict (or a team policy requires it). Add the key to Known hosts first, or switch to Ask.

It times out. The address or port may be wrong, or a firewall drops the connection. Settings › Connections & SSH › Show which hosts answer puts a dot beside each host saying whether its SSH port takes connections. A host behind a jump host is reached only through it (Connect through jump hosts).

“mosh-client not found”. Install Mosh on your computer, or turn Mosh-compatible session off for the host (Use Mosh). A host with jump hosts or a proxy cannot use Mosh at all.

A team host stops at “Changed by … at …”. Another member changed how the host connects since you last connected. Read the old and new values, and choose Connect only if the change is expected.

A port forward shows “Waiting for approval”. It listens on an address other devices can reach, or comes from a vault others can change. Start it, read what it opens, and approve it (Forward a port).

Sync and the account

The server address is refused. Use https://. Plain http:// is accepted only for a server on the same computer, and never by the phone app.

“Offline. Changes are kept and sent when the server is reachable.” The server cannot be reached. Nothing is lost: changes wait on the device. Check the address and the server’s health (curl -sf https://<server>/healthz).

A sync asks about removing many items. Another device (or the server) removed more than 20 items, or most of one kind. Nothing is removed until you choose. Keep my local data is the safe answer; it sends your items back to the server.

“The server sent an older version of N items”. This device kept its newer version and did not apply the older one. If it keeps happening, the server may have been tampered with: tell its administrator.

Signing in fails with a key-derivation error. Sternway refuses to sign in when the server asks it to derive your password’s key with less work than before, or below the minimum, so a server cannot make your password cheaper to guess. That points to a misconfigured or tampered server.

Forgot the account password. Settings › Account & Sync › Recover with a recovery kit, with the key from your kit. Without a kit, nobody can recover the encrypted data; your devices that are still signed in keep working.

“Your team requires single sign-on”. Sign in with Sign in with SSO and the organization name shown (Set up single sign-on).

Teams

“Accept the team …?” or “… shared the vault … with you”. Nothing from a team or vault is used on a device until you accept it there. Compare the owner’s safety number first.

“The team’s member list could not be verified”. A change from the server was refused and is not used; the team goes on as it was. If it stays, tell the team owner.

“… safety number changed”. The person’s account keys changed, for example after an account reset. The team is paused on this device until you compare the new number with them in person or over another channel.

A setting says “Managed by (team)”. A team policy sets it. The note gives the reason; only the team can change it (Set team policies).

The command line

Exit status 4. Sternway is not running, is locked, or something else answers where it listens. Start or unlock the app. Exit status 3 means the token was refused: make a new one in Settings › CLI tokens (Use the command line).

Security keys

Each security key message is explained in Log in with a hardware security key.