RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Description of problem:

openssh server don't list key exchange algorithm:
diffie-hellman-group-exchange-sha1 

My command

# sshd -T | grep ^kexalgorithms | cut -f2 -d' ' | tr ',' '\n'
curve25519-sha256
curve25519-sha256
ecdh-sha2-nistp256
ecdh-sha2-nistp384
ecdh-sha2-nistp521
diffie-hellman-group-exchange-sha256
diffie-hellman-group16-sha512
diffie-hellman-group18-sha512
diffie-hellman-group14-sha256
diffie-hellman-group14-sha1

But when I used ssh client connect ssh server with mis-match key exchange

There was output below:

[root@rhel85 ~]# ssh -oKexAlgorithms=diffie-hellman-group1-sha1 root@localhost
Unable to negotiate with ::1 port 22: no matching key exchange method found. 
Their offer: 
curve25519-sha256,
curve25519-sha256,
ecdh-sha2-nistp256,
ecdh-sha2-nistp384,
ecdh-sha2-nistp521,
diffie-hellman-group-exchange-sha256,
diffie-hellman-group14-sha256,
diffie-hellman-group16-sha512,
diffie-hellman-group18-sha512,
diffie-hellman-group-exchange-sha1, ----------> here
diffie-hellman-group14-sha1

Actually, openssh server support diffie-hellman-group-exchange-sha1

This command ran successfully

ssh -oKexAlgorithms=diffie-hellman-group-exchange-sha1 root@localhost

Thank you very much!

The OpenSSH algorithms in RHEL8 are handled by crypto policies so if you check what the sshd server is using with ps auxf | grep sshd, you will get more commandline arguments configuring the actually used algorithms and the `diffie-hellman-group-exchange-sha1` is in that list in default policy. There is a KBS for that, but I do not have it at hand right now. But in any case, this is not a bug, bug just confusing message.

Yes, this is in /etc/crypto-policies/back-ends/opensshserver.config

grep diffie-hellman-group-exchange-sha1 /etc/crypto-policies/back-ends/opensshserver.config

Tks