SFTP Key Exchange failing accessing latest OpenSSH on Linux server

Help & Support
1

Reference/Related: SFTP Key Exchange Algorithms

FTP Log output:
We claim version: SSH-2.0-PuTTY_Directory_Opus
Couldn't agree a host key algorithm (available: rsa-sha2-512,rsa-sha2-256,ecdsa-sha2-nistp256,ssh-ed25519)
SSH: Fatal: Couldn't agree a host key algorithm (available: rsa-sha2-512,rsa-sha2-256,ecdsa-sha2-nistp256,ssh-ed25519)

I'm trying to connect to an ArchLinux server and its running OpenSSH 8.8p1-1les.
I can connect to servers running OpenSSH 8.7p1-1.

Based on this Stackoverflow post: linux - PuTTY Fatal error: Couldn't agree on host key algorithm - Super User
is the embedded Putty version too "old" in DirectoryOpus?

2

Yes, they're only allowing relatively new algorithms, which we don't support yet. The only current options are to configure the server to allow older algorithms (making sure you understand the security implications of the one you choose, of course) or using a different client, at present.

Updating (or possibly completely replacing) that code is on our list, but not a simple task, and we have to finish some other work before we will get to it, unfortunately.

3

Thanks for the info.
Let me know if you are interested in beta testers for any new sftp/ssh code.
I'll try enabling some older ciphers on my servers.

4

Thanks!

RSA is probably the one to try. It was disabled by default in OpenSSH 8.8 installs according to the OpenSSH 8.8/8.8p1 (2021-09-26) release notes:

This release disables RSA signatures using the SHA-1 hash algorithm
by default. This change has been made as the SHA-1 hash algorithm is
cryptographically broken, and it is possible to create chosen-prefix
hash collisions for <USD$50K [1]

5

Howdy,

Any update on newer/updated ssh support in DirOpus?

Thanks

6

We have added support for the elliptic curve algorithms in 12.26.3 beta.

7

Awesome! Sorry I missed testing this in the Beta, but it is working as expected/desired in the released version. Thanks!

2 Likes