Failed to clone repository .... Underlying error: Failed to start SSH session [Especially Github repo] #153

snakelab · 2018-01-12T22:46:06Z

Hi folks,

i am getting this error at trying to clone a git repo via ssh-key which i had uploaded:

Failed to clone repository .... Underlying error: Failed to start SSH session: Unable to exchange encryption keys

Does anyone here have a tip for me?

thanks

hartmut

mssun · 2018-01-20T01:15:38Z

Which key algorithm are you using?

snakelab · 2018-01-22T21:01:24Z

hi, thanks for your help. My key is 2048 SHA256 RSA
This ist the error-message:

infinisil · 2018-01-27T06:51:15Z

Getting the same error here, same key type (which is the default for ssh-keygen)

I get the following error from sshd:

Jan 27 07:49:57 paul sshd[8630]: Unable to negotiate with 178.197.226.88 port 21947:
  no matching key exchange method found. Their offer: diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 [preauth]

snakelab · 2018-02-02T11:56:15Z

I dont use a password with the key, maybe this is a problem?!

infinisil · 2018-02-02T12:57:15Z

Well I know what's the problem and it might be a serious security concern. According to Mozilla's security guidelines, these are the recommended sshd options:


KexAlgorithms curve25519-sha256@libssh.org,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,umac-128@openssh.com

And everything else should be considered insecure. Apparently the ssh library used in passforios doesn't support any of those! Especially SHA1 is considered broken. My distro (NixOS) has set these options as default, that's why it didn't work.

The problem ultimately lies in the libssh2 version being too old since the latest one supports the necessary algorithms (libssh2 is used by libgit2 which is used by objective-git which is used to clone the repository).

@mssun I suggest you to update some versions in hoping to get a more recent libssh2

@snakelab To fix this for now, you need to have access to the git server and add the following to your sshd_config:

KexAlgorithms +diffie-hellman-group14-sha1
MACs +hmac-sha1

Edit: Actually this doesn't seem to work for me (the + syntax i mean), I have to change the declaration of KexAlgorithms and MACs to include the ones mentioned instead, not sure why. Which means my config has now this in it:

KexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,umac-128@openssh.com,hmac-sha1

See mssun/passforios#153 (comment)

mssun · 2018-02-04T01:43:31Z

@infinisil Thanks. I didn't notice this cause before. I found that objective-git points to the libssh2 (libssh2 @ f1cfa55) which is five years old.

snakelab · 2018-02-05T13:18:44Z

great work. As adding this algos is not an option for me, could it be fixed in passforios?!

awmartin · 2018-02-24T00:54:48Z

Is there a workaround for this? My host discontinued support for some of these key exchange methods, making passforios useless as-is.

posix4e · 2018-02-25T01:31:40Z

Same github just broke me

awmartin · 2018-02-25T01:33:18Z

No doubt this: https://githubengineering.com/crypto-deprecation-notice/

posix4e · 2018-02-25T01:41:49Z

I just had to switch to gitlab

jtunison · 2018-03-01T15:51:01Z

Looks like libssh2 version got bumped in objective-git on Feb 15: libgit2/objective-git@17112f5

But no objective-git release since then...

jtunison · 2018-03-01T15:51:59Z

See also #164

snakelab · 2018-03-02T10:36:28Z

This issue seems to have quite an impact to the project here, so i also opened an issue at the objective-git project and got good news:

libgit2/objective-git#641 (comment)

So it seems that passforios just need to update the objective-git libs and we all would be happy!!!!
Please just do it.... thanks @mssun

mssun · 2018-03-02T18:38:24Z

I will work on this weekend. Thanks.

…

On Mar 2, 2018, at 2:36 AM, Hartmut König ***@***.***> wrote: This issue seems to have quite an impact to the project here, so i also opened an issue at the objective-git project and got good news: libgit2/objective-git#641 (comment) <libgit2/objective-git#641 (comment)> So it seems that passforios just need to update the objective-git libs and we all would be happy!!!! Please just do it.... thanks @mssun <https://github.com/mssun> — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#153 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ABNieKDdvbN0vUV2XmpsnNF11lh5MNpsks5taSCzgaJpZM4Rc8rJ>.

tobiastom · 2018-03-06T15:13:03Z

Just for the record: this will most likely not add Ed25519 support, as that is not supported by libssh2 for now: libssh2/libssh2#39

supermarin · 2018-03-21T18:06:46Z

any updates on this?

mssun · 2018-03-25T00:30:19Z

Hi all, I'm trying to close this issue today. The only thing I can do is to use the master branch of objective-git. I don't know why I cannot use it via carthage. (libgit2/objective-git#646) Do you guys know why this could happen?

snakelab · 2018-03-25T20:38:19Z

Please send me a invite to testflight: h.koenig@snakelab.de

snakelab · 2018-04-01T21:33:47Z

Hi @mssun, it is so sad, but it is not working for me ... i got the same error at using ssh-key for my repo ... :-/

savyajha · 2018-04-08T06:40:00Z

Has there been any progress on this? Using pass with bad encryption is worse than not using it at all. :/

yishilin14 · 2018-04-08T11:23:20Z

@savyajha We are still waiting for a new ObjectivePGP release. Someone guy has been working on it.
libgit2/objective-git#643
libgit2/objective-git#645
libgit2/objective-git#648

savyajha · 2018-04-08T13:13:11Z

Oh wow. This is going to take a while, then. No worries, and thanks for letting me know. :)

johnmee · 2018-04-09T08:58:08Z

Major bummer. So if my repo is on github is there a (temporary) workaround?

eg: If I put it somewhere that is not github (my own server) and loosen the permitted algorithms, will that let me push passwords from the phone again?

yishilin14 · 2018-04-09T10:42:58Z

A temporary workaround suggested by @raxod502 in #170

Temporary workaround for me is to host my repository on GitLab rather than GitHub. (Actually, I have it on both, with GitLab mirroring automatically.)

GitLab Documentation - Repository mirroring: https://docs.gitlab.com/ee/workflow/repository_mirroring.html

snakelab · 2018-04-24T20:32:52Z

@mssun Hi bob, why don't you try this version with a newer openssl bib:

https://github.com/tiennou/objective-git/commits/master

mssun · 2018-04-25T17:07:07Z

@snakelab Did you mean this: https://github.com/tiennou/objective-git/commits/update/libgit2-0.27?

It seems that supporting latest openssl lib is still work-in-progress.

snakelab · 2018-04-30T19:55:25Z

Well, i mean this issue:
libgit2/objective-git#648
where tiennou mentioned the update to the new ssl lib....

mssun · 2018-04-30T21:39:59Z

@snakelab Thanks. I tried to build with the master branch and got an error. I have reported to the upstream: libgit2/objective-git#654

phatblat · 2018-05-03T15:23:08Z

@mssun Let me know if libgit2/objective-git#655 resolved your issues building master with Carthage

mssun · 2018-05-03T16:36:09Z

@phatblat it works. Thanks.

snakelab · 2018-05-25T17:12:06Z

@mssun is a new release coming??

mssun · 2018-05-29T16:42:41Z

@snakelab Due to an issue of objective-git, we still cannot use the latest release for now. Thanks.

jakerobers · 2018-06-04T03:19:54Z

Adding link for convenience. It looks like it will get merged soon: libgit2/objective-git#645

mssun · 2018-06-04T03:26:11Z

@snakelab Thanks, I'm following this PR.

savyajha · 2018-06-15T11:03:15Z

Asked for the linked PR to get merged, seeing as their holdup seems to have been fixed. Hopefully we'll get a fix to that issue that's blocking the upgrade of objective-git here.

mssun · 2018-06-16T00:15:44Z

Hi all, I'm releasing a test flight because of the merged PR "Update libgit2 to 0.27" (libgit2/objective-git#645). Please help me test if everything works well. Thank you!

raxod502 · 2018-06-17T03:34:27Z

I can now clone repositories from GitHub with the latest update. Thanks!

savyajha · 2018-06-17T05:04:18Z

Using it on a private server, it works with the Mozilla OpenSSH guidelines. Thank you!

snakelab · 2018-06-18T08:33:22Z

@mssun thanks for releasing this issue - it is also working for me now!

delegacy · 2018-07-21T14:55:13Z

Checked that the latest test flight app can synchronize with my GitHub repo now!

OkanEsen · 2018-07-21T15:00:34Z

Do we have any info on when we can expect this change to be pushed to production? Is there something we can do to help?

Thank you for your hard work @mssun!

KjellConnelly · 2018-07-27T23:25:13Z

I'm having the same error... is this being pushed to the App Store? If not, can you add me to testflight?

pbnsilva · 2018-08-01T15:40:59Z

Any ETA on app store release ?
Thanks for your work.

yishilin14 · 2018-09-30T17:48:06Z

Version 0.5.0 (commits: 824b959) should have fixed the problem in this issue.

Testflight: Jun 16
App Store: about a month ago

If you guys are unable to clone via SSH, I think it is because of some other reasons (e.g., problematic setup, unsupported key algorithms, unsupported key format).

Please fire a new issue with more detailed information for further discussion/suggestions/debugging purposes.

infinisil added a commit to infinisil/system that referenced this issue Feb 2, 2018

sshd: fix for passforios

3886ab7

See mssun/passforios#153 (comment)

infinisil added a commit to infinisil/system that referenced this issue Feb 2, 2018

sshd: fix for passforios

51d755a

See mssun/passforios#153 (comment)

jtunison mentioned this issue Mar 1, 2018

Unable to clone repo from Github #164

Closed

mssun mentioned this issue Mar 27, 2018

Unable to clone repo #171

Closed

savyajha mentioned this issue Apr 2, 2018

Failed to clone repository: Failed to start SSH Session: Unable to exchange encryption keys. #170

Closed

yishilin14 changed the title ~~Failed to clone repository .... Underlying error: Failed to start SSH session~~ Failed to clone repository .... Underlying error: Failed to start SSH session [Especially Github repo] Apr 9, 2018

infinisil mentioned this issue Apr 20, 2018

nixos/sshd: add options for kexAlgorithms, ciphers and MACs NixOS/nixpkgs#39232

Merged

8 tasks

mssun added the to be tested label Jun 17, 2018

OkanEsen mentioned this issue Jul 21, 2018

SSH Clone Failure #200

Closed

tobiastom mentioned this issue Aug 15, 2018

SSH clone error #192

Closed

yishilin14 closed this as completed Sep 30, 2018

yishilin14 removed the to be tested label Sep 30, 2018

adamoudad mentioned this issue Jul 29, 2024

Failed to clone repository: Unable to exchange encryption keys #620

Open

Failed to clone repository .... Underlying error: Failed to start SSH session [Especially Github repo] #153

Failed to clone repository .... Underlying error: Failed to start SSH session [Especially Github repo] #153

Comments

snakelab commented Jan 12, 2018

mssun commented Jan 20, 2018

snakelab commented Jan 22, 2018 • edited Loading

infinisil commented Jan 27, 2018

snakelab commented Feb 2, 2018 • edited Loading

infinisil commented Feb 2, 2018 • edited Loading

mssun commented Feb 4, 2018 • edited Loading

snakelab commented Feb 5, 2018

awmartin commented Feb 24, 2018

posix4e commented Feb 25, 2018

awmartin commented Feb 25, 2018

posix4e commented Feb 25, 2018

jtunison commented Mar 1, 2018

jtunison commented Mar 1, 2018

snakelab commented Mar 2, 2018

mssun commented Mar 2, 2018 via email

tobiastom commented Mar 6, 2018

supermarin commented Mar 21, 2018

mssun commented Mar 25, 2018

snakelab commented Mar 25, 2018

snakelab commented Apr 1, 2018

savyajha commented Apr 8, 2018

yishilin14 commented Apr 8, 2018

savyajha commented Apr 8, 2018

johnmee commented Apr 9, 2018

yishilin14 commented Apr 9, 2018

snakelab commented Apr 24, 2018

mssun commented Apr 25, 2018

snakelab commented Apr 30, 2018

mssun commented Apr 30, 2018

phatblat commented May 3, 2018

mssun commented May 3, 2018

snakelab commented May 25, 2018

mssun commented May 29, 2018

jakerobers commented Jun 4, 2018

mssun commented Jun 4, 2018

savyajha commented Jun 15, 2018

mssun commented Jun 16, 2018

raxod502 commented Jun 17, 2018

savyajha commented Jun 17, 2018

snakelab commented Jun 18, 2018

delegacy commented Jul 21, 2018

OkanEsen commented Jul 21, 2018

KjellConnelly commented Jul 27, 2018

pbnsilva commented Aug 1, 2018 • edited Loading

yishilin14 commented Sep 30, 2018

snakelab commented Jan 22, 2018 •

edited

Loading

snakelab commented Feb 2, 2018 •

edited

Loading

infinisil commented Feb 2, 2018 •

edited

Loading

mssun commented Feb 4, 2018 •

edited

Loading

pbnsilva commented Aug 1, 2018 •

edited

Loading