Subject: Bug#1373: kex error : no match for method mac algo

From: Danie de Jager <[email-masked]>
Date: Mon, 18 Feb 2019 11:07:37 +0200

Package: client

The client does not support chacha20 as I get this error when I try to
connect to the X2Go server. I did harden my SSH configuration as guided by
Mozzila
https://infosec.mozilla.org/guidelines/openssh

When I use defaults it works fine. It seems that the library used by X2Go
is missing some newer methods.

Config:
server ssh config:
KexAlgorithms [email-masked]
,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256
Ciphers [email-masked],[email-masked],
[email-masked],aes256-ctr,aes192-ctr,aes128-ctr
MACs [email-masked],[email-masked],
[email-masked],hmac-sha2-512,hmac-sha2-256,[email-masked]

Client sshd config:
Client using default sshd config

or

HashKnownHosts yes
HostKeyAlgorithms [email-masked],
[email-masked],ssh-ed25519,ssh-rsa,
[email-masked],
[email-masked],
[email-masked]
,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256
KexAlgorithms [email-masked]
,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256
MACs [email-masked],[email-masked],
[email-masked],hmac-sha2-512,hmac-sha2-256,[email-masked]
Ciphers [email-masked],[email-masked],
[email-masked],aes256-ctr,aes192-ctr,aes128-ctr

Error:
"kex error : no match for method mac algo client->server: server [
[email-masked],[email-masked],
[email-masked],hmac-sha2-512,hmac-sha2-256,[email-masked]],
client [hmac-sha1]"

or sometimes

"crypt_set_algorithms2: no crypto algorithm function found for
[email-masked]"

Let me know if I can provide more information.

Regards,
*Danie de Jager*

---

From: Antenore <[email-masked]>
Date: Mon, 18 Feb 2019 11:22:16 +0100

Package: client

Hi Daniel,

I'm just a reader, but X2GO uses libssh, that support the Kex you are
using, so first of all, you have to install an updated version of libssh
and eventually check if it has been compiled with the support of these
algorithms.

Normally, I think, on the X2GO side there is nothing more to do.

Have a look here:

https://www.libssh.org/features/

---

From: Danie de Jager <[email-masked]>
Date: Mon, 18 Feb 2019 13:24:37 +0200

Thanks for your input. Maybe the client ships in a way where it is compiled
to only support MACs of
[email-masked],hmac-sha1

When I add these to my server I can SSH to it and see remote screen with
X2GO client. If I change the server's SSHD config and remove the 2 sha1
MACs I can still shh to the server but X2Go client stops working. To get
the libssh updated for my OS won't necissarily allow the client to use it
if the client was statically compiled using an older version.

On Mon, 18 Feb 2019 at 12:22, Antenore <[email-masked]> wrote:

> ],

---

From: Antenore Gatta <[email-masked]>
Date: Mon, 18 Feb 2019 10:24:41 +0100

Hi Daniel,

Have a look here:

On Mon, 18 Feb 2019 11:07:37 +0200
Danie de Jager <[email-masked]> wrote:

> connect to the X2Go server. I did harden my SSH configuration as
> guided by Mozzila
> When I use defaults it works fine. It seems that the library used by
> X2Go is missing some newer methods.
> 
> Config:
> server ssh config:

---

From: Mike Gabriel <[email-masked]>
Date: Mon, 18 Feb 2019 20:36:55 +0000

Control: reassign -1 x2goclient
Control: forcemerge #1374 -1

> [...]

Doing some bts major domo work...

Mike
-- 

DAS-NETZWERKTEAM
c\o Technik- und Ökologiezentrum Eckernförde
Mike Gabriel, Marienthaler str. 17, 24340 Eckernförde
mobile: +49 (1520) 1976 148
landline: +49 (4354) 8390 139

GnuPG Fingerprint: 9BFB AEE8 6C0A A5FF BF22  0782 9AF4 6B30 2577 1B31
mail: [email-masked], http://das-netzwerkteam.de