Cannot connect to recent OpenBSD SSHD.

[vext01]

Hi connecting to my OpenBSD-current server irssi-connectbot hangs and I see the following in the sshd log on the server:

May 23 21:13:39 kryten3 sshd[22038]: fatal: no matching mac found: client hmac-sha1-96,hmac-sha1,hmac-md5-96,hmac-md5 server umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512 [preauth]

Perhaps OpenBSD has a more strict default that expected?

[vext01]

For what it's worth, I can connect using the ssh binary from terminal emulator on my phone, but not using irssi connectbot. Seems like a connectbot issue.

[vext01]

I think this is related to this: http://www.openbsd.org/faq/current.html#20140603

Weak or broken hashes, ciphers and modes were removed from the
default sshd(8) configuration. Some clients do not support any of the
methods which are now available by default, so will not be able to connect
without changes. In those cases, the client should be updated or replaced.

I recommend switching to JuiceSSH in the meantime:
https://sonelli.com/

Sadly this replacement is not open source.

[viernullvier]

Seems to be already fixed in upstream ConnectBot. This fork however still relies exclusively on weak and broken algorithms and should be updated ASAP.

As of now, the following algorithms can be considered strong and secure:

KexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-ripemd160-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-ripemd160,umac-128@openssh.com

[nyetwurk]

Unable to negotiate with xxxx port 48448: no matching key exchange method found. Their offer: diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1

almost 6 years later, still no real improvement. Time to abandon this app.