程式扎記: [ Java 常見問題 ] JSch - com.jcraft.jsch.JSchException: Algorithm negotiation fail

標籤

2016年2月1日 星期一

[ Java 常見問題 ] JSch - com.jcraft.jsch.JSchException: Algorithm negotiation fail

Source From Here
Question
We have one of our Windows server setup as sFTP server using Cygwin and OpenSSH and the java based client application was using Jsch library to communicate with the sFTP server. Recently, we upgraded the Cygwin and since then our client application started getting connection errors:
com.jcraft.jsch.JSchException: Algorithm negotiation fail
at com.jcraft.jsch.Session.receive_kexinit(Session.java:583)
at com.jcraft.jsch.Session.connect(Session.java:320)
at com.jcraft.jsch.Session.connect(Session.java:183)
at org.pfl.sftp.JschWrapper.transferFile(JschWrapper.java:36)

I enabled debug and the debug log is:
  1. Remote version string: SSH-2.0-OpenSSH_6.7  
  2. Local version string: SSH-2.0-JSCH-0.1.51  
  3. CheckCiphers: aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-ctr,arcfour,arcfour128,arcfour256  
  4. aes256-cbc is not available.  
  5. aes192-cbc is not available.  
  6. CheckKexes: diffie-hellman-group14-sha1  
  7. diffie-hellman-group14-sha1 is not available.  
  8. SSH_MSG_KEXINIT sent  
  9. SSH_MSG_KEXINIT received  
  10. kex: server: curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1  
  11. kex: server: ssh-rsa,ssh-dss  
  12. kex: server: aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com  
  13. kex: server: aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com  
  14. kex: server: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1  
  15. kex: server: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1  
  16. kex: server: none,zlib@openssh.com  
  17. kex: server: none,zlib@openssh.com  
  18. kex: server:   
  19. kex: server:   
  20. kex: client: diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1  
  21. kex: client: ssh-rsa,ssh-dss  
  22. kex: client: aes128-ctr,aes128-cbc,3des-ctr,3des-cbc,blowfish-cbc  
  23. kex: client: aes128-ctr,aes128-cbc,3des-ctr,3des-cbc,blowfish-cbc  
  24. kex: client: hmac-md5,hmac-sha1,hmac-sha2-256,hmac-sha1-96,hmac-md5-96  
  25. kex: client: hmac-md5,hmac-sha1,hmac-sha2-256,hmac-sha1-96,hmac-md5-96  
  26. kex: client: none  
  27. kex: client: none  
  28. kex: client:   
  29. kex: client:   
  30. Disconnecting from 10.30.194.91 port 22  
  31. com.jcraft.jsch.JSchException: Algorithm negotiation fail  
  32.   at com.jcraft.jsch.Session.receive_kexinit(Session.java:583)  
  33.   at com.jcraft.jsch.Session.connect(Session.java:320)  
  34.   at com.jcraft.jsch.Session.connect(Session.java:183)  
  35.   at org.pfl.sftp.JschWrapper.transferFile(JschWrapper.java:36)    
It is clearly evident from the logs that there is no common Kex algorithm between server and client and thats the reason for the failure.

Server Kex Algorithms
kex: server: curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1

Client Kex Algorithms
kex: client: diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1

But it was working earlier and there is no change in the client side code. So, we had a look at the Cygwin installation again and found that the older version of Cygwin was installed with OpenSSH 5.1 and the new version is with OpenSSH 6.7 - The Server support team upgraded the OpenSSH version along with Cygwin upgrade. There was no explicit KexAlgorithms configuration in sshd_config file and hence OpenSSH was taking the default list of KexAlgorithms.
Default KexAlgorithms for OpenSSH 5.1
diffie-hellman-group-exchange-sha256,
diffie-hellman-group-exchange-sha1,
diffie-hellman-group14-sha1,
diffie-hellman-group1-sha1

Default KexAlgorithms for OpenSSH 6.7
curve25519-sha256@libssh.org,
ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,
diffie-hellman-group-exchange-sha256,
diffie-hellman-group14-sha1

The algorithms supported by client (diffie-hellman-group1-sha1 and diffie-hellman-group-exchange-sha1are not part of the OpenSSH 6.7 default list any more.

Solution
Adding diffie-hellman-group1-sha1 and/or diffie-hellman-group-exchange-sha1 to OpenSSH 6.7 KexAlgorithms list would solve the issue. Follow the below steps:
1. Open /etc/sshd_config
2. Add the following at the end of the file
  1. KexAlgorithms diffie-hellman-group1-sha1  
3. Save the file and restart the sshd service.

I added diffie-hellman-group1-sha1, but you can add either one or add all the algorithms supported by client. This config will override the default list, So, if you want your algorithm along with default list, then you can put the default list as well, as given below:
  1. KexAlgorithms diffie-hellman-group1-sha1,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1  


沒有留言:

張貼留言

網誌存檔

關於我自己

我的相片
Where there is a will, there is a way!