/ Register

Learn about Centmin Mod LEMP Stack today
Become a Member

Sysadmin cURL on centOS6 wont connect to Centos7

Discussion in 'System Administration' started by GASTAN, Aug 14, 2019.

Previous Thread Next Thread
Loading...
  1. Aug 14, 2019 #1
    GASTAN

    GASTAN Member

    111
    12
    18
    Jun 28, 2017
    Ratings:
    +19
    Local Time:
    10:14 AM
    I wanted to upload backup form one server to another and cannot make curl to work.
    finaly found on destination server this (in messages):
    no matching key exchange method found. Their offer: diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 [preauth]

    so I guess CentOS 6 uses older Ciphers which CentOS7 (sshd) does not like.
    But after couple hours of googling I cannot figure out how to fix this.
    I am so desperate I decided to write here, even though it's not really CentminMod related

    any ideas (alternatively other methods of uploading file) are appreciated
     
  2. Aug 14, 2019 #2
    eva2000

    eva2000 Administrator Staff Member

    58,894
    12,490
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +19,122
    Local Time:
    6:14 PM
    Nginx 1.31.x
    MariaDB 10.x/11.4+/12.3+
    are centos 6 and/or centos 7 servers Centmin Mod based ?
     
  3. Aug 15, 2019 #3
    GASTAN

    GASTAN Member

    111
    12
    18
    Jun 28, 2017
    Ratings:
    +19
    Local Time:
    10:14 AM
    yup, updated yesterday
     
  4. Aug 15, 2019 #4
    eva2000

    eva2000 Administrator Staff Member

    58,894
    12,490
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +19,122
    Local Time:
    6:14 PM
    Nginx 1.31.x
    MariaDB 10.x/11.4+/12.3+
    what does the output for these 2 command return for both centos 6 and centos 7 servers
    Code (Text):
    egrep '^KexAlgorithms|^Ciphers|^MACs' /etc/ssh/sshd_config

    has centos 6 ever in past worked with centos 7 server for this ?
     
  5. Aug 15, 2019 #5
    GASTAN

    GASTAN Member

    111
    12
    18
    Jun 28, 2017
    Ratings:
    +19
    Local Time:
    10:14 AM
    6:
    KexAlgorithms ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1


    7:
    KexAlgorithms curve25519-sha256@libssh.org,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256
    Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr
    MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,umac-128@openssh.com
     
  6. Aug 15, 2019 #6
    eva2000

    eva2000 Administrator Staff Member

    58,894
    12,490
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +19,122
    Local Time:
    6:14 PM
    Nginx 1.31.x
    MariaDB 10.x/11.4+/12.3+
    are you using curl to connect to sshd ? or ssh to sshd connection ?

    you may need to use a tool other than curl on centos 6

    https://bugzilla.redhat.com/show_bug.cgi?id=1688081

    Code (Text):
     If you disable sha-1 KEX/MACs in openssh then sftp is no longer
  able to connect on both RHEL 6 and 7.

  curl only supports the following:

    KEX algorithms: diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 [preauth]
    MACs ctos: hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com [preauth]

   openssh after removing sha-1:

     KEX algorithms: curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256 [preauth]
     MACs ctos: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512 [preauth]


Version-Release number of selected component (if applicable):

  curl-7.29.0-51.el7.x86_64
  openssh-7.4p1-16.el7.x86_64


    https://www.openssh.com/legacy.html

    the 3 in centos 6 for diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
    aren't specifically setup as supported in centos 7's KexAlgorithms though I don't recall if centos 7 native disabled them anyway so you can try adding to centos 7 version the missing ones though as mentioned above it's less secure/weaker
    Code (Text):
    KexAlgorithms curve25519-sha256@libssh.org,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1

    then restart sshd service

    FYI, for posting code or output from commands to keep the formatting, you might want to use CODE tags for code How to use forum BBCODE code tags :)
     
  7. Aug 17, 2019 #7
    GASTAN

    GASTAN Member

    111
    12
    18
    Jun 28, 2017
    Ratings:
    +19
    Local Time:
    10:14 AM
    unfortunately it did not work.
    I added your line to Cent7 restarted sshd, no joy
    now /var/log/secure says:

    Code:
     Unable to negotiate with [ip] port 54988: no matching MAC found. Their offer: hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd16
    curl worked before (destination server was centos6)

    any idea what should I use instead?
     
  8. Aug 17, 2019 #8
    GASTAN

    GASTAN Member

    111
    12
    18
    Jun 28, 2017
    Ratings:
    +19
    Local Time:
    10:14 AM
    I ended up with scp.
    Do you know of any free cloud storages that I could upload from CentOS6 to?
    I have some 50GB mega.nz but I dont think I can scp there :(
     
Previous Thread Next Thread
Loading...

.