3

Just installed a new server with Debian8 (jessie) system. Many years use CuteFTP to upload/synchronize files on home computer and server using SFTP connection. Unfortunately, CuteFTP can not connect to Deabian8 servers:

Disconnect: key exchange failed.
ERROR:>     [22/06/2016 15:10:03] Check security settings; make sure that the username and password are correct, and that the chosen encryption algorithms are supported by server.

I installed WinSCP and there is no problem to connect to the server. Just CuteFTP acn not connect. But I want to use CuteFTP because it has scheduled synchronization, multiple simultaneous upload/download possibility etc.

Any ideas why CuteFTP can not connect to the Debian8 servers?

* CuteFTP 9.0 - build Jun 25 2013 *

STATUS:>    [22/06/2016 15:10:02] Getting listing ""...
STATUS:>    [22/06/2016 15:10:02] Connecting to SFTP server... XXX.XXX.XXX.XXX:1641 (ip = XXX.XXX.XXX.XXX)...
ERROR:>     [22/06/2016 15:10:03] Disconnect: key exchange failed.
ERROR:>     [22/06/2016 15:10:03] Check security settings; make sure that the username and password are correct, and that the chosen encryption algorithms are supported by server.
STATUS:>    [22/06/2016 15:10:03] Can't connect to XXX.XXX.XXX.XXX:1641.
STATUS:>    [22/06/2016 15:10:03] SFTP connection closed.

LOG:

18:28:24.085 Sending version: 5353482D322E302D312E3832207373686C69623A20436C69656E74536674700D0A

18:28:24.135 Sending SSH_MSG_KEXINIT (450 bytes, seq nr 0)
Data: 14D0989582300732FE96FA99757E553326000000596469666669652D68656C6C6D616E2D67726F757031342D736861312C6469666669652D68656C6C6D616E2D67726F75702D65786368616E67652D736861312C6469666669652D68656C6C6D616E2D67726F7570312D736861310000000F7373682D7273612C7373682D6473730000005A336465732D6362632C617263666F75722C636173743132382D6362632C74776F666973682D6362632C626C6F77666973682D6362632C74776F666973683132382D6362632C6165733132382D6362632C6165733235362D6362630000005A336465732D6362632C617263666F75722C636173743132382D6362632C74776F666973682D6362632C626C6F77666973682D6362632C74776F666973683132382D6362632C6165733132382D6362632C6165733235362D6362630000002B686D61632D6D64352C686D61632D736861312C686D61632D736861312D39362C686D61632D6D64352D39360000002B686D61632D6D64352C686D61632D736861312C686D61632D736861312D39362C686D61632D6D64352D3936000000097A6C69622C6E6F6E65000000097A6C69622C6E6F6E6500000000000000000000000000

18:28:24.137 GsSshClientManager::OnKexStart: Starting first key exchange

18:28:24.538 PacketDecoder RECEIVED: 5353482D322E302D4F70656E5353485F362E3770312044656269616E2D352B6465623875320D0A0000026C0914F58C399FF69574E104443DF5AC29F83E000000636469666669652D68656C6C6D616E2D67726F75702D65786368616E67652D7368613235362C6469666669652D68656C6C6D616E2D67726F757031342D736861312C6469666669652D68656C6C6D616E2D67726F75702D65786368616E67652D73686131000000137373682D7273612C7373682D65643235353139000000436165733235362D67636D406F70656E7373682E636F6D2C6165733132382D67636D406F70656E7373682E636F6D2C6165733235362D6374722C6165733132382D637472000000436165733235362D67636D406F70656E7373682E636F6D2C6165733132382D67636D406F70656E7373682E636F6D2C6165733235362D6374722C6165733132382D6374720000007F686D61632D736861322D3531322D65746D406F70656E7373682E636F6D2C686D61632D736861322D3235362D65746D406F70656E7373682E636F6D2C756D61632D3132382D65746D406F70656E7373682E636F6D2C686D61632D736861322D3531322C686D61632D736861322D3235362C686D61632D726970656D643136300000007F686D61632D736861322D3531322D65746D406F70656E7373682E636F6D2C686D61632D736861322D3235362D65746D406F70656E7373682E636F6D2C756D61632D3132382D65746D406F70656E7373682E636F6D2C686D61632D736861322D3531322C686D61632D736861322D3235362C686D61632D726970656D64313630000000156E6F6E652C7A6C6962406F70656E7373682E636F6D000000156E6F6E652C7A6C6962406F70656E7373682E636F6D00000000000000000000000000000000000000000000

18:28:24.547 GsSshClientManager::OnInStateChange: Server version string: SSH-2.0-OpenSSH_6.7p1 Debian-5+deb8u2
Protocol version: 2.0

18:28:24.549 Received SSH_MSG_KEXINIT (610 bytes, seq nr 0)
Data: 14F58C399FF69574E104443DF5AC29F83E000000636469666669652D68656C6C6D616E2D67726F75702D65786368616E67652D7368613235362C6469666669652D68656C6C6D616E2D67726F757031342D736861312C6469666669652D68656C6C6D616E2D67726F75702D65786368616E67652D73686131000000137373682D7273612C7373682D65643235353139000000436165733235362D67636D406F70656E7373682E636F6D2C6165733132382D67636D406F70656E7373682E636F6D2C6165733235362D6374722C6165733132382D637472000000436165733235362D67636D406F70656E7373682E636F6D2C6165733132382D67636D406F70656E7373682E636F6D2C6165733235362D6374722C6165733132382D6374720000007F686D61632D736861322D3531322D65746D406F70656E7373682E636F6D2C686D61632D736861322D3235362D65746D406F70656E7373682E636F6D2C756D61632D3132382D65746D406F70656E7373682E636F6D2C686D61632D736861322D3531322C686D61632D736861322D3235362C686D61632D726970656D643136300000007F686D61632D736861322D3531322D65746D406F70656E7373682E636F6D2C686D61632D736861322D3235362D65746D406F70656E7373682E636F6D2C756D61632D3132382D65746D406F70656E7373682E636F6D2C686D61632D736861322D3531322C686D61632D736861322D3235362C686D61632D726970656D64313630000000156E6F6E652C7A6C6962406F70656E7373682E636F6D000000156E6F6E652C7A6C6962406F70656E7373682E636F6D00000000000000000000000000

18:28:24.551 Will act on first key exchange method packet

18:28:24.552 GsSshClientManager::OnInStateChange: Server's KEXINIT packet:
cookie:         F58C399FF69574E104443DF5AC29F83E
kex algs:       diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1
host key algs:  ssh-rsa,ssh-ed25519
c2s encr algs:  aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes128-ctr
s2c encr algs:  aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes128-ctr
c2s mac algs:   hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-ripemd160
s2c mac algs:   hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-ripemd160
c2s cmpr algs:  none,zlib@openssh.com
s2c cmpr algs:  none,zlib@openssh.com
c2s languages:  
s2c languages:  
1. kex follows: false


18:28:24.554 Sending SSH_MSG_DISCONNECT (72 bytes, seq nr 1)
Data: 0100000003000000396661696C656420746F206E65676F746961746520636C69656E7420746F2073657276657220656E6372797074696F6E20616C676F726974686D00000002656E

18:28:24.556 DoLoopThread exit: Disconnect packet sent:
Disconnect reason: SSH_DISCONNECT_KEY_EXCHANGE_FAILED
Disconnect description: failed to negotiate client to server encryption algorithm
Disconnect language: en


18:28:25.220 GsSftpImplementation::~GsSftpImplementation
aigffmss
  • 147
  • 2
  • 8
  • 1
    Can you post a more verbose log? I have the feeling that CuteFTP and your Debian SSH server (OpenSSH?) cannot negotiate a Key Exchange Algorithm supported by both parties. – FjodrSo Jun 22 '16 at 15:17
  • I just updated my pust and published all the messages that I see. I don't know where to find "more verbose log" in CuteFtp. – aigffmss Jun 22 '16 at 17:09
  • Still not enough. I don't use CuteFTP, but most FTP/SFTP clients do have an option for a more verbose (or debug) log. Need to see the KEX algorithms offered by the server and the ones supported by your client. Anyway, I'm 99.9% positive that's a Key Exchange Algorithm negotiation issue. – FjodrSo Jun 22 '16 at 17:12
  • Here's an explanation of how to enable a more verbose logging with CuteFTP: http://help.globalscape.com/help/cuteftp8/Log_file_settings.htm – FjodrSo Jun 22 '16 at 17:23
  • Found i logfile and updated my post. – aigffmss Jun 22 '16 at 17:31

2 Answers2

3

Looking at your log file, apparently 3 key exchange algorithms are available:

diffie-hellman-group-exchange-sha256, diffie-hellman-group14-sha1, diffie-hellman-group-exchange-sha1

With diffie-hellman-group-exchange-sha256 being the preferential one, as advertised by the server.

The host has probably 2 keys: one RSA key and one ED25519 key. The ED25519 key cannot be used with any of the 3 advertised KEX algorithms, so I am assuming your CuteFTP client is trying to KEX on the RSA key, and should do so via the SHA256-based KEX.

To my knowledge, CuteFTP allows you to configure the Encryption and the HMAC algorithms, but does not have a specific configuration to set the precedence of the KEX algorithms. This said I would recommend you to update to the most recent version of CuteFTP and see if it solves the issue, or stop using CuteFTP.

Of course you could also change the preference order of the KEX algorithms on the server, but since the two SHA1-based are now considered insecure (and not PCI-compliant) I do not recommend to do so. It's bettere to improve the client side, rather than weakening the server's security settings.

FjodrSo
  • 294
  • 1
  • 6
1

This is the naswer from Globalscape

=================== Hello,

Based off of the information provided, I believe that the failure comes from CuteFTP and it not being capable with using SHA2 http://help.globalscape.com/help/cuteftp9/learning_about_ssh2.htm

It is unknown at this time if CuteFTP 9 will be revisited for supporting newer ciphers and MACS.

So, don't buy CuteFTP. They even don't know if they are going to fix the problem.

aigffmss
  • 147
  • 2
  • 8