"Algorithm negotiation fail" on sftp

[Trallali]

I get "Algorithm negotiation fail" on a sftp connection, which has not been changed for months. User+Password are correct, e.g. FileZilla on PC or the sftp-Plugin for TotalCommander on the phone works fine with the same credentials. A new "file open" doesn't work, with the same message. Any idea?
Provider is DomainFactory. Contact me if you want a test account or more information. German is fine.

Thanks

[pc-coholic]

I can confirm this bug - funnily enough also with DomainFactory...

[Trallali]

I asked DomainFactory. They updated some server components. Since then, they use stronger SSL ciphers. Which fits with the error message "algorithm negotiatian fail". So please @PhilippC , could you check if support for the stronger ciphers is possible? Which are, according to the blog entry:

• Ciphers [email protected],[email protected],aes256-ctr,aes192-ctr,aes128-ctr
• KexAlgorithms [email protected],ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256
• MACs [email protected],[email protected]

Thanks

[pc-coholic]

I guess, then the problem could be solved by simply updating the JSch-component, which is (iirc) right now at 0.1.50.

According to their Change-Log, 0.1.51 and 0.1.52 seem to introduce those missing KexAlgorithms, we're looking for (except for curve).

[jstachowiak]

Hi! This is also an issue to me. Could you please update JSch to the latest version (0.1.54)? JSch 0.1.50 was released on May 9, 2013 (almost 5 years ago!) and does not support modern TLS/SSL cipher suites. We don't want to use outdated insecure cipher suites. I can help out with testing.

Thanks!

[pc-coholic]

There is already #48 on the milestone list for 1.05 that should (hopefully) take care of this issue.

[B4rc1]

In case someone comes across this like I did:

This happens because in openssh 8.8p1 ssh-rsa got disabled by default (source). The fix was adding the following (source) to my servers sshd config:

HostKeyAlgorithms +ssh-rsa
PubkeyAcceptedKeyTypes +ssh-rsa

[PhilippC]

just found #1812 as a duplicate of this issue. I'm closing this, howevre, because the other one has more upvotes.