Bug 1953591 - Impossible to connect through SSH servers that use old KEX
Summary: Impossible to connect through SSH servers that use old KEX
Keywords:
Status: CLOSED WONTFIX
Alias: None
Product: Fedora
Classification: Fedora
Component: remmina
Version: 34
Hardware: x86_64
OS: Linux
unspecified
high
Target Milestone: ---
Assignee: Phil Wyett
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2021-04-26 12:54 UTC by Andrea Oliveri
Modified: 2022-01-28 20:04 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2022-01-28 20:04:53 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)

Description Andrea Oliveri 2021-04-26 12:54:55 UTC
Description of problem:
Impossible to connect to servers that use old KEX algoritms
If you try to connect to (for example) RDP server through a SSH tunnel and the SSH server uses only old KEX algorithm Remmina returns 

"Could not start SSH session. kex error: no match for method server host key algo: server [ssh-rsa,ssh-dss], client [rsa-sha2-256,rsa-sha2-512,ecdsa-sha2-nistp256,ecdsa-sha2-nistp521,ssh-ed25519]"

while a ordinary ssh client is able to connects.
I think is the same as:
https://gitlab.com/Remmina/Remmina/-/issues/983

Comment 1 Simone Caronni 2021-04-27 06:05:47 UTC
Remmina uses libssh for the SSH connection, have you tried to switch from the DEFAULT crypto policy?

$ cat /usr/share/crypto-policies/DEFAULT/libssh.txt | grep Kex
KexAlgorithms curve25519-sha256,curve25519-sha256,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512

This one above is from Fedora 33, the 34 one is a bit further restrictive.

Comment 2 Andrea Oliveri 2021-04-30 09:09:43 UTC
Fedora 34 has the same output for the default crypto policy but previously, on Fedora 33, remmina worked with that server. However, if I set crypto policy to "LEGACY" it works :) thanks


Note You need to log in before you can comment on or make changes to this bug.