Connections using hmac-etm gets closed by remote host

[flux-johnm]

Expected behavior

Connection should be established.

Actual behavior

After negotiation, the connection gets dropped

D, [2023-05-31T12:15:49.481314 #13] DEBUG -- net.ssh.transport.session[53994]: establishing connection to *:22 through proxy
D, [2023-05-31T12:15:49.521082 #13] DEBUG -- net.ssh.transport.session[53994]: connection established
I, [2023-05-31T12:15:49.521173 #13]  INFO -- net.ssh.transport.server_version[539a8]: negotiating protocol version
D, [2023-05-31T12:15:49.521201 #13] DEBUG -- net.ssh.transport.server_version[539a8]: local is `SSH-2.0-Ruby/Net::SSH_7.1.0 x86_64-linux'
D, [2023-05-31T12:15:49.579041 #13] DEBUG -- net.ssh.transport.server_version[539a8]: remote is `SSH-2.0-OpenSSH_6.6'
I, [2023-05-31T12:15:49.579542 #13]  INFO -- net.ssh.transport.algorithms[539bc]: sending KEXINIT
D, [2023-05-31T12:15:49.579703 #13] DEBUG -- socket[539d0]: queueing packet nr 0 type 20 len 1436
D, [2023-05-31T12:15:49.579762 #13] DEBUG -- socket[539d0]: sent 1440 bytes
D, [2023-05-31T12:15:49.581667 #13] DEBUG -- socket[539d0]: read 1344 bytes
D, [2023-05-31T12:15:49.581720 #13] DEBUG -- socket[539d0]: received packet nr 0 type 20 len 1340
I, [2023-05-31T12:15:49.581752 #13]  INFO -- net.ssh.transport.algorithms[539bc]: got KEXINIT from server
I, [2023-05-31T12:15:49.581856 #13]  INFO -- net.ssh.transport.algorithms[539bc]: negotiating algorithms
D, [2023-05-31T12:15:49.581925 #13] DEBUG -- net.ssh.transport.algorithms[539bc]: negotiated:
* kex: diffie-hellman-group14-sha1
* host_key: ssh-rsa
* encryption_server: aes256-ctr
* encryption_client: aes256-ctr
* hmac_client: hmac-sha2-512-etm@openssh.com
* hmac_server: hmac-sha2-512-etm@openssh.com
* compression_client: none
* compression_server: none
* language_client:
* language_server:
D, [2023-05-31T12:15:49.581952 #13] DEBUG -- net.ssh.transport.algorithms[539bc]: exchanging keys
D, [2023-05-31T12:15:49.584252 #13] DEBUG -- socket[539d0]: queueing packet nr 1 type 30 len 268
D, [2023-05-31T12:15:49.584297 #13] DEBUG -- socket[539d0]: sent 272 bytes
D, [2023-05-31T12:15:49.616233 #13] DEBUG -- socket[539d0]: read 0 bytes
/bundle/ruby/3.0.0/bundler/gems/net-ssh-4007b247c157/lib/net/ssh/transport/packet_stream.rb:108:in `block in next_packet': connection closed by remote host (Net::SSH::Disconnect)
	from /bundle/ruby/3.0.0/bundler/gems/net-ssh-4007b247c157/lib/net/ssh/transport/packet_stream.rb:102:in `loop'
	from /bundle/ruby/3.0.0/bundler/gems/net-ssh-4007b247c157/lib/net/ssh/transport/packet_stream.rb:102:in `next_packet'
	from /bundle/ruby/3.0.0/bundler/gems/net-ssh-4007b247c157/lib/net/ssh/transport/session.rb:193:in `block in poll_message'
	from /bundle/ruby/3.0.0/bundler/gems/net-ssh-4007b247c157/lib/net/ssh/transport/session.rb:190:in `loop'
	from /bundle/ruby/3.0.0/bundler/gems/net-ssh-4007b247c157/lib/net/ssh/transport/session.rb:190:in `poll_message'
	from /bundle/ruby/3.0.0/bundler/gems/net-ssh-4007b247c157/lib/net/ssh/transport/session.rb:175:in `next_message'
	from /bundle/ruby/3.0.0/bundler/gems/net-ssh-4007b247c157/lib/net/ssh/transport/kex/diffie_hellman_group1_sha1.rb:97:in `send_kexinit'
	from /bundle/ruby/3.0.0/bundler/gems/net-ssh-4007b247c157/lib/net/ssh/transport/kex/abstract.rb:48:in `exchange_keys'
	from /bundle/ruby/3.0.0/bundler/gems/net-ssh-4007b247c157/lib/net/ssh/transport/algorithms.rb:448:in `exchange_keys'
	from /bundle/ruby/3.0.0/bundler/gems/net-ssh-4007b247c157/lib/net/ssh/transport/algorithms.rb:248:in `proceed!'
	from /bundle/ruby/3.0.0/bundler/gems/net-ssh-4007b247c157/lib/net/ssh/transport/algorithms.rb:187:in `accept_kexinit'
	from /bundle/ruby/3.0.0/bundler/gems/net-ssh-4007b247c157/lib/net/ssh/transport/session.rb:210:in `block in poll_message'
	from /bundle/ruby/3.0.0/bundler/gems/net-ssh-4007b247c157/lib/net/ssh/transport/session.rb:190:in `loop'
	from /bundle/ruby/3.0.0/bundler/gems/net-ssh-4007b247c157/lib/net/ssh/transport/session.rb:190:in `poll_message'
	from /bundle/ruby/3.0.0/bundler/gems/net-ssh-4007b247c157/lib/net/ssh/transport/session.rb:227:in `block in wait'
	from /bundle/ruby/3.0.0/bundler/gems/net-ssh-4007b247c157/lib/net/ssh/transport/session.rb:224:in `loop'

System configuration

• local is `SSH-2.0-Ruby/Net::SSH_7.1.0 x86_64-linux'
• remote is `SSH-2.0-OpenSSH_6.6'
• ruby 3.0

[flux-johnm]

Is the etm only supported on OpenSSH7 and above?

[fwininger]

OpenSSH 6.2/6.2p1 (2013-03-22)

Changes since OpenSSH 6.1

• ssh(1)/sshd(8): Added support for encrypt-then-mac (EtM) MAC modes
  for SSH protocol 2. These modes alter the packet format and compute
  the MAC over the packet length and encrypted packet rather than over
  the plaintext data. These modes are considered more secure and are
  used by default when available.

[fwininger]

@flux-johnm what os distro do you use ?

[mfazekas]

@flux-johnm pls report you os, relevant server config. Also pls check /var/log/auth.log for relevant log line for clues on what went wrong. Ideal would be a repro with a VM, so we can also reproduce.