Unable to exchange encryption keys

[iamgrf]

Problematic on ubuntu 22.04, { code: Session(-5), msg: "Unable to exchange encryption keys" }

[ZodiacWind]

I have encountered the same question, but on Windows 11. Is there anyone who knows how to deal with the issuse? Thx.

[WillBuik]

I'm encountering the same issue on Windows 11:

let tcp = TcpStream::connect(addr).context("Connection failed")?;
let mut ssh_session = Session::new()?;
ssh_session.set_tcp_stream(tcp);
ssh_session.handshake().context("Handshake failed")?; // Fails here "[Session(-5)] Unable to exchange encryption keys"

This code works when connecting to some machines but not others. I can connect to Ubuntu 20.04 but connecting to Ubuntu 22.04 fails with the error above. I'm using "vendored-openssl" and this same code works fine on recent MacOS to connect to both distros.

If there are any other logs or diagnostics that would be helpful to diagnose this, let me know.

[yodaldevoid]

What were you two trying to connect to? What type of keys were you trying to use if any?

[M-Saeb]

Same error here, I'm not passing any encryption key

let tcp = TcpStream::connect(tcp_address).unwrap();
let mut session = Session::new().unwrap();
session.set_tcp_stream(tcp);
session.handshake().unwrap(); // error raised on this line
session.userauth_password(
   username,
   password
).unwrap();

I'm using window 10 and trying to connect to Ubuntu 22.04.1 LTS

[redstonerti]

I have the same issue on windows 11 trying to connect to Arch Linux with kernel 6.0.10

[boonkerz]

same here

[Leghart]

Seen the same issue on CentOS. Isn't this related to libssh2/libssh2#1020 ?

[maxbruegge]

Having the same issue using Windows 10.

[rannday]

I was having this issue connecting to a Juniper switch (EX4100-F-12T) from Windows 11. I was able to resolve it by adding this config bit to my Juniper device: set system services ssh hostkey-algorithm-list rsa.

https://www.juniper.net/documentation/us/en/software/junos/cli-reference/topics/ref/statement/system-edit-ssh-hostkey-algorithm-list.html

Configure the specified SSH hostkey algorithms. The system automatically disables the remaining unspecified hostkey algorithms.

[RichardWarfield]

There's a good chance this is related in many cases to #323; some distros/systems are only enabling encrypt-then-MAC MACs now. A workaround may be to add e.g. hmac-sha2-256 / hmac-sha2-512 to the "MACs" table in sshd_config. These are considered somewhat less secure than the -etm counterparts, but encrypt-then-mac isn't supported until this library is updated to use ssh2 1.11.0.