SshException: MAC Error

[chucklu]

Hi,
When I try to clone by ssh protocol, I got the following error log on gitblit.

2018-04-17 15:47:29 [INFO ] creating ssh session from /172.31.212.138:53820
2018-04-17 15:47:29 [WARN ] Exception caught
org.apache.sshd.common.SshException: MAC Error
at org.apache.sshd.common.session.AbstractSession.decode(AbstractSession.java:818)
at org.apache.sshd.common.session.AbstractSession.messageReceived(AbstractSession.java:331)
at org.apache.sshd.common.session.AbstractSessionIoHandler.messageReceived(AbstractSessionIoHandler.java:57)
at org.apache.sshd.common.io.nio2.Nio2Session$2.onCompleted(Nio2Session.java:220)
at org.apache.sshd.common.io.nio2.Nio2Session$2.onCompleted(Nio2Session.java:212)
at org.apache.sshd.common.io.nio2.Nio2CompletionHandler$1.run(Nio2CompletionHandler.java:34)
at java.security.AccessController.doPrivileged(Native Method)
at org.apache.sshd.common.io.nio2.Nio2CompletionHandler.completed(Nio2CompletionHandler.java:31)
at sun.nio.ch.Invoker.invokeUnchecked(Unknown Source)
at sun.nio.ch.Invoker$2.run(Unknown Source)
at sun.nio.ch.AsynchronousChannelGroupImpl$1.run(Unknown Source)
at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)
at java.lang.Thread.run(Unknown Source)

[kaymccormick]

This bug is preventing me from using gitblit - I get it when trying to push to a gitblit repos. I guess I haven't tried cloning, since I cant create any repos yet.

[fbacchella]

I solved that by putting that setup in my ~/.ssh/config for the gitblit server:

    HostKeyAlgorithms ssh-rsa
    KexAlgorithms ecdh-sha2-nistp256
    MACs hmac-sha2-256
    Ciphers aes128-ctr

[flaix]

@fbacchella , does it mean you encountered it, too, or were able to reproduce it? What setup would reproduce the error?

[fbacchella]

I had the problem when I tried to secure my ssh client, using Mozilla recommendations.

This setup fails:

    HostKeyAlgorithms ssh-ed25519-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-ed25519,ssh-rsa,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256
    KexAlgorithms curve25519-sha256@libssh.org,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256
    MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,umac-128@openssh.com
    Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr

[flaix]

In this case the error was caused by a bug in MINA SSHD (SSHD-604). Your config prefers hmac-sha2-512 over hmac-sha2-256, which the Gitblit SSHD agrees to. But the implementation used the wrong algorithm.
This is fixed in the next GitBlit version.
I just don't know if it fixes @chucklu's problem, as I believe there could be multiple causes to a MAC error.

[fbacchella]

next GitBlit version ? That would be so nice.

[flaix]

@fbacchella , the code is done, as far as I am concerned. The rest is managerial stuff.
If you like and are running an instance from your own build, you could update to the current master and give it a run.