Debian – Can not connect to the Debian 8 servers with CuteFTP

debiandebian-jessiesftp

Just installed a new server with Debian8 (jessie) system.
Many years use CuteFTP to upload/synchronize files on home computer and server using SFTP connection. Unfortunately, CuteFTP can not connect to Deabian8 servers:

Disconnect: key exchange failed.
ERROR:>     [22/06/2016 15:10:03] Check security settings; make sure that the username and password are correct, and that the chosen encryption algorithms are supported by server.

I installed WinSCP and there is no problem to connect to the server. Just CuteFTP acn not connect. But I want to use CuteFTP because it has scheduled synchronization, multiple simultaneous upload/download possibility etc.

Any ideas why CuteFTP can not connect to the Debian8 servers?

* CuteFTP 9.0 – build Jun 25 2013 *

STATUS:>    [22/06/2016 15:10:02] Getting listing ""...
STATUS:>    [22/06/2016 15:10:02] Connecting to SFTP server... XXX.XXX.XXX.XXX:1641 (ip = XXX.XXX.XXX.XXX)...
ERROR:>     [22/06/2016 15:10:03] Disconnect: key exchange failed.
ERROR:>     [22/06/2016 15:10:03] Check security settings; make sure that the username and password are correct, and that the chosen encryption algorithms are supported by server.
STATUS:>    [22/06/2016 15:10:03] Can't connect to XXX.XXX.XXX.XXX:1641.
STATUS:>    [22/06/2016 15:10:03] SFTP connection closed.

LOG:

18:28:24.085 Sending version: 5353482D322E302D312E3832207373686C69623A20436C69656E74536674700D0A

18:28:24.135 Sending SSH_MSG_KEXINIT (450 bytes, seq nr 0)
Data: 14D0989582300732FE96FA99757E553326000000596469666669652D68656C6C6D616E2D67726F757031342D736861312C6469666669652D68656C6C6D616E2D67726F75702D65786368616E67652D736861312C6469666669652D68656C6C6D616E2D67726F7570312D736861310000000F7373682D7273612C7373682D6473730000005A336465732D6362632C617263666F75722C636173743132382D6362632C74776F666973682D6362632C626C6F77666973682D6362632C74776F666973683132382D6362632C6165733132382D6362632C6165733235362D6362630000005A336465732D6362632C617263666F75722C636173743132382D6362632C74776F666973682D6362632C626C6F77666973682D6362632C74776F666973683132382D6362632C6165733132382D6362632C6165733235362D6362630000002B686D61632D6D64352C686D61632D736861312C686D61632D736861312D39362C686D61632D6D64352D39360000002B686D61632D6D64352C686D61632D736861312C686D61632D736861312D39362C686D61632D6D64352D3936000000097A6C69622C6E6F6E65000000097A6C69622C6E6F6E6500000000000000000000000000

18:28:24.137 GsSshClientManager::OnKexStart: Starting first key exchange

18:28:24.538 PacketDecoder RECEIVED: 5353482D322E302D4F70656E5353485F362E3770312044656269616E2D352B6465623875320D0A0000026C0914F58C399FF69574E104443DF5AC29F83E000000636469666669652D68656C6C6D616E2D67726F75702D65786368616E67652D7368613235362C6469666669652D68656C6C6D616E2D67726F757031342D736861312C6469666669652D68656C6C6D616E2D67726F75702D65786368616E67652D73686131000000137373682D7273612C7373682D65643235353139000000436165733235362D67636D406F70656E7373682E636F6D2C6165733132382D67636D406F70656E7373682E636F6D2C6165733235362D6374722C6165733132382D637472000000436165733235362D67636D406F70656E7373682E636F6D2C6165733132382D67636D406F70656E7373682E636F6D2C6165733235362D6374722C6165733132382D6374720000007F686D61632D736861322D3531322D65746D406F70656E7373682E636F6D2C686D61632D736861322D3235362D65746D406F70656E7373682E636F6D2C756D61632D3132382D65746D406F70656E7373682E636F6D2C686D61632D736861322D3531322C686D61632D736861322D3235362C686D61632D726970656D643136300000007F686D61632D736861322D3531322D65746D406F70656E7373682E636F6D2C686D61632D736861322D3235362D65746D406F70656E7373682E636F6D2C756D61632D3132382D65746D406F70656E7373682E636F6D2C686D61632D736861322D3531322C686D61632D736861322D3235362C686D61632D726970656D64313630000000156E6F6E652C7A6C6962406F70656E7373682E636F6D000000156E6F6E652C7A6C6962406F70656E7373682E636F6D00000000000000000000000000000000000000000000

18:28:24.547 GsSshClientManager::OnInStateChange: Server version string: SSH-2.0-OpenSSH_6.7p1 Debian-5+deb8u2
Protocol version: 2.0

18:28:24.549 Received SSH_MSG_KEXINIT (610 bytes, seq nr 0)
Data: 14F58C399FF69574E104443DF5AC29F83E000000636469666669652D68656C6C6D616E2D67726F75702D65786368616E67652D7368613235362C6469666669652D68656C6C6D616E2D67726F757031342D736861312C6469666669652D68656C6C6D616E2D67726F75702D65786368616E67652D73686131000000137373682D7273612C7373682D65643235353139000000436165733235362D67636D406F70656E7373682E636F6D2C6165733132382D67636D406F70656E7373682E636F6D2C6165733235362D6374722C6165733132382D637472000000436165733235362D67636D406F70656E7373682E636F6D2C6165733132382D67636D406F70656E7373682E636F6D2C6165733235362D6374722C6165733132382D6374720000007F686D61632D736861322D3531322D65746D406F70656E7373682E636F6D2C686D61632D736861322D3235362D65746D406F70656E7373682E636F6D2C756D61632D3132382D65746D406F70656E7373682E636F6D2C686D61632D736861322D3531322C686D61632D736861322D3235362C686D61632D726970656D643136300000007F686D61632D736861322D3531322D65746D406F70656E7373682E636F6D2C686D61632D736861322D3235362D65746D406F70656E7373682E636F6D2C756D61632D3132382D65746D406F70656E7373682E636F6D2C686D61632D736861322D3531322C686D61632D736861322D3235362C686D61632D726970656D64313630000000156E6F6E652C7A6C6962406F70656E7373682E636F6D000000156E6F6E652C7A6C6962406F70656E7373682E636F6D00000000000000000000000000

18:28:24.551 Will act on first key exchange method packet

18:28:24.552 GsSshClientManager::OnInStateChange: Server's KEXINIT packet:
cookie:         F58C399FF69574E104443DF5AC29F83E
kex algs:       diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1
host key algs:  ssh-rsa,ssh-ed25519
c2s encr algs:  aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes128-ctr
s2c encr algs:  aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes128-ctr
c2s mac algs:   hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-ripemd160
s2c mac algs:   hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-ripemd160
c2s cmpr algs:  none,zlib@openssh.com
s2c cmpr algs:  none,zlib@openssh.com
c2s languages:  
s2c languages:  
1. kex follows: false


18:28:24.554 Sending SSH_MSG_DISCONNECT (72 bytes, seq nr 1)
Data: 0100000003000000396661696C656420746F206E65676F746961746520636C69656E7420746F2073657276657220656E6372797074696F6E20616C676F726974686D00000002656E

18:28:24.556 DoLoopThread exit: Disconnect packet sent:
Disconnect reason: SSH_DISCONNECT_KEY_EXCHANGE_FAILED
Disconnect description: failed to negotiate client to server encryption algorithm
Disconnect language: en


18:28:25.220 GsSftpImplementation::~GsSftpImplementation

Best Answer

Looking at your log file, apparently 3 key exchange algorithms are available:

diffie-hellman-group-exchange-sha256, diffie-hellman-group14-sha1, diffie-hellman-group-exchange-sha1

With diffie-hellman-group-exchange-sha256 being the preferential one, as advertised by the server.

The host has probably 2 keys: one RSA key and one ED25519 key. The ED25519 key cannot be used with any of the 3 advertised KEX algorithms, so I am assuming your CuteFTP client is trying to KEX on the RSA key, and should do so via the SHA256-based KEX.

To my knowledge, CuteFTP allows you to configure the Encryption and the HMAC algorithms, but does not have a specific configuration to set the precedence of the KEX algorithms. This said I would recommend you to update to the most recent version of CuteFTP and see if it solves the issue, or stop using CuteFTP.

Of course you could also change the preference order of the KEX algorithms on the server, but since the two SHA1-based are now considered insecure (and not PCI-compliant) I do not recommend to do so. It's bettere to improve the client side, rather than weakening the server's security settings.

Related Solutions

Debian – Running Stable and Installing Packages from Testing

Many people seem to be afraid of mixing stable with testing, but frankly, testing is fairly stable in its own right, and with proper preferences and solution checking, you can avoid the "stability drift" that puts your core packages on the unstable path.

"Testing is fairly stable??", you ask. Yes. In order for a package to migrate from unstable to testing, it has to have zero open bugs for 10 consecutive days. Chances are that, especially for the more popular packages, somebody is going to submit a bug report for an unstable version if something is wrong.

Even if you don't want to mix the environments, it's still nice to have the option there in case you run into something that requires a newer version than what is in stable.

Here's what I recommend for setting this up:

First, create the following files in /etc/apt/preferences.d:

stable.pref:

# 500 <= P < 990: causes a version to be installed unless there is a
# version available belonging to the target release or the installed
# version is more recent

Package: *
Pin: release a=stable
Pin-Priority: 900

testing.pref:

# 100 <= P < 500: causes a version to be installed unless there is a
# version available belonging to some other distribution or the installed
# version is more recent

Package: *
Pin: release a=testing
Pin-Priority: 400

unstable.pref:

# 0 < P < 100: causes a version to be installed only if there is no
# installed version of the package

Package: *
Pin: release a=unstable
Pin-Priority: 50

experimental.pref:

# 0 < P < 100: causes a version to be installed only if there is no
# installed version of the package

Package: *
Pin: release a=experimental
Pin-Priority: 1

(Don't be afraid of the unstable/experimental stuff here. The priorities are low enough that it's never going to automatically install any of that stuff. Even the testing branch will behave, as it's only going to install the packages you want to be in testing.)

Now, creating a matching set for /etc/apt/sources.list.d:

stable.list: Copy from your original /etc/apt/sources.list. Rename the old file to something like sources.list.orig.

testing.list: Same as stable.list, except with testing.

unstable.list: Same as stable.list, except with unstable, and remove the security lists.

experimental.list: Same as unstable.list, except with experimental.

You can also add a oldstable in sources.lists.d and preferences.d (use a priority of 1), though this moniker will tend to expire and disappear before the next stable cycle. In cases like that, you can use http://archive.debian.org/debian/ and "hardcode" the Debian version (etch, lenny, etc.).

To install the testing version of a package, simply use aptitude install lib-foobar-package/testing, or just jump into aptitude's GUI and select the version inside of the package details (hit enter on the package you're looking at).

If you get complaints of package conflicts, look at the solutions first. In most cases, the first one is going to be "don't install this version". Learn to use the per-package accept/reject resolver choices. For example, if you're installing foobar-package/testing, and the first solution is "don't install foobar-package/testing", then mark that choice as rejected, and the other solutions will never veer to that path again. In cases like these, you'll probably have to install a few other testing packages.

If it's getting too hairy (like it's trying to upgrade libc or the kernel or some other huge core system), then you can either reject those upgrade paths or just back out of the initial upgrade altogether. Remember that it's only going to upgrade stuff to testing/unstable if you allow it to.

EDIT: Fixed some priority pins, and updated the list.

How to you do a one liner with sftp to login with the password on the same line

Generally including a password in a command line is considered a security risk because it will show up to anyone else who can run ps/top, and it may be saved in your shell's history.

It would be a much better idea to setup key-based authentication if you are able.

Also, I don't believe it is going to be possible with sftp. It is meant to be used for secure transfers. If you really had to do something like this and you have no other choice then you probably need to be looking at automating with expect.

Best Answer

Related Solutions

Debian – Running Stable and Installing Packages from Testing

How to you do a one liner with sftp to login with the password on the same line

Related Topic