Failed to clone repository .... Underlying error: Failed to start SSH session [Especially Github repo]

[snakelab]

Hi folks,

i am getting this error at trying to clone a git repo via ssh-key which i had uploaded:

Failed to clone repository .... Underlying error: Failed to start SSH session: Unable to exchange encryption keys

Does anyone here have a tip for me?

thanks

hartmut

[mssun]

Which key algorithm are you using?

[snakelab]

hi, thanks for your help. My key is 2048 SHA256 RSA
This ist the error-message:

[infinisil]

Getting the same error here, same key type (which is the default for ssh-keygen)

I get the following error from sshd:

Jan 27 07:49:57 paul sshd[8630]: Unable to negotiate with 178.197.226.88 port 21947:
  no matching key exchange method found. Their offer: diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 [preauth]

[snakelab]

I dont use a password with the key, maybe this is a problem?!

[infinisil]

Well I know what's the problem and it might be a serious security concern. According to Mozilla's security guidelines, these are the recommended sshd options:

KexAlgorithms curve25519-sha256@libssh.org,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,umac-128@openssh.com

And everything else should be considered insecure. Apparently the ssh library used in passforios doesn't support any of those! Especially SHA1 is considered broken. My distro (NixOS) has set these options as default, that's why it didn't work.

The problem ultimately lies in the libssh2 version being too old since the latest one supports the necessary algorithms (libssh2 is used by libgit2 which is used by objective-git which is used to clone the repository).

@mssun I suggest you to update some versions in hoping to get a more recent libssh2

@snakelab To fix this for now, you need to have access to the git server and add the following to your sshd_config:

KexAlgorithms +diffie-hellman-group14-sha1
MACs +hmac-sha1

Edit: Actually this doesn't seem to work for me (the + syntax i mean), I have to change the declaration of KexAlgorithms and MACs to include the ones mentioned instead, not sure why. Which means my config has now this in it:

KexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,umac-128@openssh.com,hmac-sha1

[mssun]

@infinisil Thanks. I didn't notice this cause before. I found that objective-git points to the libssh2 (libssh2 @ f1cfa55) which is five years old.

[snakelab]

great work. As adding this algos is not an option for me, could it be fixed in passforios?!

[awmartin]

Is there a workaround for this? My host discontinued support for some of these key exchange methods, making passforios useless as-is.

[posix4e]

Same github just broke me

[awmartin]

No doubt this: https://githubengineering.com/crypto-deprecation-notice/

[posix4e]

I just had to switch to gitlab

[jtunison]

Looks like libssh2 version got bumped in objective-git on Feb 15: libgit2/objective-git@17112f5

But no objective-git release since then...