Does the latest version of Rebex SFTP/SSH for .NET support OpenSSH V6.1.x?

Question

We have a customer of ours who upgraded to the latest OpenSSH version (V 6.2p2-0.21.1), and they are now getting a key exchange failed error when using your Rebex SSH component. We have extracted a log from their output, and we would like some assistance trying to figure out if this is an issue with your assembly or our software. We’re getting a “Key exchange failed” error.

On the server side the error is:

DEVGDB1 sshd[9186]: fatal: DH_GEX_REQUEST, bad parameters: 1536 !< 1024 !< 8192 [preauth]

Could you please assist? Let me know if there is any additional information I can provide.

Here is the exception that we get:

2015-10-26 15:27:20.936 DEBUG Ssh(5973)[21] SSH: Group exchange. 
2015-10-26 15:27:20.936 VERBOSE Ssh(5973)[21] SSH: Sending packet SSH_MSG_KEX_30 (5 bytes). 
0000 |1E-00-00-04-00 | ..... 
2015-10-26 15:27:20.936 DEBUG Ssh(5973)[21] SSH: SSH connection closed. 
2015-10-26 15:27:20.936 DEBUG Ssh(5973)[21] SSH: Negotiation failed: Rebex.Net.SshException: Key exchange failed. The connection was closed by the server. ---> Rebex.Net.SshException: The connection was closed by the server. 
at Rebex.Net.SshSession.ReceivePacket(SshLayer layer) 
at Rebex.Net.SshDiffieHellmanGroupExchangeNegotiation.Negotiate(SshSession session, Byte[] V_C, Byte[] V_S, Byte[] I_C, Byte[] I_S, Byte[]& K, Byte[]& H, SshPublicKey& serverKey) 
at Rebex.Net.SshSession.Negotiate(Byte[] I_S)

Answer 1

The issue that you experience has been already resolved in version 2014 R1 of Rebex components ("SSH: Standard form of SSH_MSG_KEX_DH_GEX_REQUEST packets is used with recent OpenSSH servers instead of its legacy form.").

Explanation:
newer OpenSSH server versions (namely 5 and 6) do not like old legacy version of DH_GEX_REQUEST packet that old Rebex SFTP client was sending.
Moreover, the issue only demonstrated itself when DiffieHellmanGroupExchangeSHA256 algorithm was picked as the preferred key exchange algorithm.

There is an automatic workaround since Rebex SFTP 2014 R1 that sends a new DH_GEX_REQUEST containing more information which makes our SFTP client compatible with latest OpenSSH servers.

So at first, please try to update to the latest version of Rebex components - if you have an active support contract, just download it under your account. Or download the latest free trial from http://www.rebex.net/ssh-pack/download.aspx or
http://www.rebex.net/sftp.net/download.aspx

If for some reason you are reluctant to update, then another option for you would be to turn off DiffieHellmanGroupExchangeSHA256 and only use the SHA-1.
This should make the old version of Rebex SFTP usable even with the newer versions of OpenSSH servers:

        Sftp sftp = new Sftp();
        sftp.Settings.SshParameters.KeyExchangeAlgorithms &= ~SshKeyExchangeAlgorithm.DiffieHellmanGroupExchangeSHA256;
        sftp.Connect("sftp-server.com");

Just please note that SHA-1 is nearing to its end and is considered almost deprecated by today’s security standards,
so sticking to SHA-1 would not last forever as servers will stop support it in a while. So an update to new version of Rebex SFTP/SSH is the recommended solution here.