Net::SSH::Exception: could not settle on encryption_client algorithm in latest release (v3)

[baburdick]

E, [2020-05-14T18:50:10.101974 #6474] ERROR -- : Net::SSH::Exception: could not settle on encryption_client algorithm
Server encryption_client preferences: twofish256-cbc,twofish-cbc,twofish128-cbc,blowfish-cbc,3des-cbc,arcfour,cast128-cbc,aes256-cbc,aes128-cbc
Client encryption_client preferences: aes256-ctr,aes192-ctr,aes128-ctr
/usr/local/rvm/gems/ruby-2.4.6@my_service/gems/net-ssh-6.0.2/lib/net/ssh/transport/algorithms.rb:394:in `negotiate'
/usr/local/rvm/gems/ruby-2.4.6@my_service/gems/net-ssh-6.0.2/lib/net/ssh/transport/algorithms.rb:369:in `negotiate_algorithms'
/usr/local/rvm/gems/ruby-2.4.6@my_service/gems/net-ssh-6.0.2/lib/net/ssh/transport/algorithms.rb:245:in `proceed!'
/usr/local/rvm/gems/ruby-2.4.6@my_service/gems/net-ssh-6.0.2/lib/net/ssh/transport/algorithms.rb:185:in `accept_kexinit'
/usr/local/rvm/gems/ruby-2.4.6@my_service/gems/net-ssh-6.0.2/lib/net/ssh/transport/session.rb:210:in `block in poll_message'
/usr/local/rvm/gems/ruby-2.4.6@my_service/gems/net-ssh-6.0.2/lib/net/ssh/transport/session.rb:190:in `loop'
/usr/local/rvm/gems/ruby-2.4.6@my_service/gems/net-ssh-6.0.2/lib/net/ssh/transport/session.rb:190:in `poll_message'
/usr/local/rvm/gems/ruby-2.4.6@my_service/gems/net-ssh-6.0.2/lib/net/ssh/transport/session.rb:225:in `block in wait'
/usr/local/rvm/gems/ruby-2.4.6@my_service/gems/net-ssh-6.0.2/lib/net/ssh/transport/session.rb:223:in `loop'
/usr/local/rvm/gems/ruby-2.4.6@my_service/gems/net-ssh-6.0.2/lib/net/ssh/transport/session.rb:223:in `wait'
/usr/local/rvm/gems/ruby-2.4.6@my_service/gems/net-ssh-6.0.2/lib/net/ssh/transport/session.rb:90:in `initialize'
/usr/local/rvm/gems/ruby-2.4.6@my_service/gems/net-ssh-6.0.2/lib/net/ssh.rb:251:in `new'
/usr/local/rvm/gems/ruby-2.4.6@my_service/gems/net-ssh-6.0.2/lib/net/ssh.rb:251:in `start'
/usr/local/rvm/gems/ruby-2.4.6@my_service/gems/net-sftp-3.0.0/lib/net/sftp.rb:36:in `start'

Rolling back to v2.1.2 restores functionality.

[baburdick]

It looks like some of these should be acceptable until net-ssh v7. But the client is defaulting to the three remaining secure ciphers.

How do I tell the client in v3 to include aes256-cbc,aes128-cbc in its preferences?

[fakefarm]

I'm here for the same reason.

   Net::SSH::Exception:
       could not settle on encryption_client algorithm
       Server encryption_client preferences: 3des-cbc,aes256-cbc,aes128-cbc
       Client encryption_client preferences: aes256-ctr,aes192-ctr,aes128-ctr

[fakefarm]

Solved over here: net-ssh/net-ssh#780

[baburdick]

That's "a" solution. But it seems fairly coarse. No way to more tightly control which algorithms you're willing to use? A badly configured server could default to a truly poor algorithm. Unless I'm misconceiving of this, some are much more easily exploitable.