no matching key exchange method found

Asked by Janis Eisaks on 2015-07-30

H!

I have a problem updating trunk having ssh with allowed DH key length 2048 and above.

Logging on: bzr launchpad-login USER
Updating trunk...
ssh_dispatch_run_fatal: Connection to 91.189.95.84: no matching key exchange method found
ConnectionReset reading response for 'BzrDir.open_2.1', retrying
ssh_dispatch_run_fatal: Connection to 91.189.95.84: no matching key exchange method found
bzr: ERROR: Connection closed: Unexpected end of message. Please check connectivity and permissions, and report a bug if problems persist.

I think it deserves special attention as ssh v.7.0 will put some limits on the key size: http://www.openssh.com/txt/release-6.9

Janis

Question information

Language:
English Edit question
Status:
Answered
For:
Launchpad itself Edit question
Assignee:
No assignee Edit question
Last query:
2015-08-19
Last reply:
2015-12-09

This question was reopened

Launchpad Janitor (janitor) said : #1

This question was expired because it remained in the 'Open' state without activity for the last 15 days.

Janis Eisaks (jancs) said : #2

The problem still exists and no solution is provided

Janis Eisaks (jancs) said : #3

additional comment:

it is not possible to update trunk if ssh.conf has such setting:
KexAlgorithms <email address hidden>,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256

Janis Eisaks (jancs) said : #4

additional comment:

it is not possible to update trunk if ssh.conf has such setting:
KexAlgorithms <email address hidden>,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256

Amos Ng (amosjyng) said : #5

Just got this error too. bzr worked earlier but no longer, no idea why. I'm on Windows.

Amos Ng (amosjyng) said : #6

It works again after I do

bzr config --remove launchpad_username --scope bazaar

It appears the problem only occurs when I'm logged into launchpad.

Janis Eisaks (jancs) said : #7

In my case - I have to be logged on as I need to submit changes to the trunk.

Colin Watson (cjwatson) said : #8

We know about this and are working on it; it's of special concern to me since I maintain the openssh packages as well. It's taking a little while because we need to get changes made in the Twisted project first, and then we need to organise an upgrade at our end which unfortunately brings in its own dependency chain. I've linked to the bug that tracks this.

As far as workarounds go, this comes under: http://www.openssh.com/legacy.html

I've put this in my .ssh/config:

Host 91.189.95.84
        KexAlgorithms +diffie-hellman-group1-sha1

No luck... This is using cygwin on Windows 10.

What is the correct workaround? It's not good that I can no longer update our branch...

Colin Watson (cjwatson) said : #10

Peter, I would expect it to have to be "Host bazaar.launchpad.net", not "Host 91.189.95.84"; Host normally must be the value specified on the ssh command-line, which in this case is going to be bazaar.launchpad.net under the hood.

After making that change, if it still doesn't work then please post the output of "ssh -vvv bazaar.launchpad.net".

To be clear, you need:

  Host bazaar.launchpad.net
          KexAlgorithms +diffie-hellman-group1-sha1

Thanks, that helped!

Colin Watson (cjwatson) said : #12

Per my update in the linked bug, you no longer need "Host bazaar.launchpad.net" "KexAlgorithms +diffie-hellman-group1-sha1" and should remove it from your configuration. Some other Launchpad SSH services still require similar configuration though.

Colin Watson (cjwatson) said : #13

In case you haven't noticed based on updates to the linked bug: this problem is now fixed and you can simply use the default crypto settings in OpenSSH 7.1 with Launchpad servers.

Can you help with this problem?

Provide an answer of your own, or ask Janis Eisaks for more information if necessary.

To post a message you must log in.