algorithm negotiation failed with mocana server

Hello,

I'm experiencing a failing algorithms negotiation with a mocana ssh server.

I tracked the exchanges and found out that the error is sent just after the client sent its KEY_EXCHANGE_INIT to the server. The error is a "Logged out" error code 11 (disconnected by the application server).

I connect without any problem to the server using an OpenSSH client.
I have no access to the remote equipment logs, so the error description I'm leaving is pretty poor, sorry.

[nicknill]

The same with dropbear server.

Here is debug info

D, [2013-02-19T09:58:19.612676 #27910] DEBUG -- net.ssh.transport.session[..fdbb83a2a]: connection established
I, [2013-02-19T09:58:19.612973 #27910]  INFO -- net.ssh.transport.server_version[..fdbb822e2]: negotiating protocol version
D, [2013-02-19T09:58:20.060019 #27910] DEBUG -- net.ssh.transport.server_version[..fdbb822e2]: remote is `SSH-2.0-dropbear_0.46'
D, [2013-02-19T09:58:20.060233 #27910] DEBUG -- net.ssh.transport.server_version[..fdbb822e2]: local is `SSH-2.0-Ruby/Net::SSH_2.6.3 i386-linux'
D, [2013-02-19T09:58:20.478303 #27910] DEBUG -- tcpsocket[..fdbb82b7a]: read 168 bytes
D, [2013-02-19T09:58:20.478951 #27910] DEBUG -- tcpsocket[..fdbb82b7a]: received packet nr 0 type 20 len 164
I, [2013-02-19T09:58:20.479230 #27910]  INFO -- net.ssh.transport.algorithms[..fdbb81612]: got KEXINIT from server
I, [2013-02-19T09:58:20.479582 #27910]  INFO -- net.ssh.transport.algorithms[..fdbb81612]: sending KEXINIT
D, [2013-02-19T09:58:20.480167 #27910] DEBUG -- tcpsocket[..fdbb82b7a]: queueing packet nr 0 type 20 len 1508
D, [2013-02-19T09:58:20.480543 #27910] DEBUG -- tcpsocket[..fdbb82b7a]: sent 1512 bytes
I, [2013-02-19T09:58:20.480695 #27910]  INFO -- net.ssh.transport.algorithms[..fdbb81612]: negotiating algorithms
D, [2013-02-19T09:58:20.481089 #27910] DEBUG -- net.ssh.transport.algorithms[..fdbb81612]: negotiated:
* kex: diffie-hellman-group1-sha1
* host_key: ssh-rsa
* encryption_server: 3des-cbc
* encryption_client: 3des-cbc
* hmac_client: hmac-sha1
* hmac_server: hmac-sha1
* compression_client: none
* compression_server: none
* language_client: 
* language_server: 
D, [2013-02-19T09:58:20.481255 #27910] DEBUG -- net.ssh.transport.algorithms[..fdbb81612]: exchanging keys
D, [2013-02-19T09:58:20.485801 #27910] DEBUG -- tcpsocket[..fdbb82b7a]: queueing packet nr 1 type 30 len 140
D, [2013-02-19T09:58:20.485987 #27910] DEBUG -- tcpsocket[..fdbb82b7a]: sent 144 bytes
D, [2013-02-19T09:58:23.410487 #27910] DEBUG -- tcpsocket[..fdbb82b7a]: read 0 bytes
Unknown error: connection closed by remote host

I found out what is causing the bug, but it sound to be a server-side bug.

When removing the two values 'ecdh-sha2-nistp256' and 'ecdh-sha2-nistp384' from Net::SSH::Transport::Algorithms::ALGORITHMS[:kex], everything works fine !

In my case, I wrote a patch rewriting a method as follow:

::Net::SSH::Transport::Algorithms.class_eval do
  def send_kexinit
    # Patch for server disconnection
    algorithms[:kex].delete('ecdh-sha2-nistp256')
    algorithms[:kex].delete('ecdh-sha2-nistp384')

    # Original code
    info { "sending KEXINIT" }
    @pending = true
    packet = build_client_algorithm_packet
    @client_packet = packet.to_s
    session.send_message(packet)
    proceed! if @server_packet
  end
end

As I said, I suppose this is a server side bug, because in case of a unknown algorithm name, it should ignore it, but not respond with a error code 11.

nicknill, I wait for a feedback from you confirming the same cause from your side before closing the bug.

[nicknill]

you're right, it's server-side bug.
It's seems that i have another bug, because in my case server close connection when exchanging keys, and patch didn't help.

Anyway thank you!

Ok so I close the bug.

I suggest you to try to use limited algorithms possibilities for connection, in order to isolate the one(s) causing troubles. That's how I proceeded.

I copied the code from https://github.com/net-ssh/net-ssh/blob/master/lib/net/ssh/transport/algorithms.rb and kept only a few algorithms possibilities to have a working case. Then I added algorithms one by one until I found the one(s) causing trouble.

# Code execute before calling Net::SSH.start()
Net::SSH::Transport::Algorithms::ALGORITHMS = {
  :host_key    => %w(ssh-rsa ssh-dss),
  :kex         => %w(diffie-hellman-group-exchange-sha1
                      diffie-hellman-group1-sha1),
  :encryption  => %w(aes128-cbc 3des-cbc blowfish-cbc),
  :hmac        => %w(hmac-sha1 hmac-md5 none),
  :compression => %w(none),
  :language    => %w() 
}

Good luck