Getting Algorithm negotiation fail while trying to connect to sftp server using Jsch in java

Question

Am trying to establish a connection with the SFTP Server using the below code (which was working fine earlier) but recently am facing the error log as provided below -

Info - Am using the below versions

Java version "1.8.0_101"
Java(TM) SE Runtime Environment (build 1.8.0_101-b13)
JSch - 0.1.54
Junit - 4.12

Am using the below code -

JSch jsch = new JSch();

Properties configuration = new Properties();
configuration.put("cipher.s2c", 
                   "aes128-ctr,aes128-cbc,3des-ctr,3des-cbc,blowfish-cbc,aes192-ctr,aes192-cbc,aes256-ctr,aes256-cbc");
configuration.put("cipher.c2s",
                   "aes128-ctr,aes128-cbc,3des-ctr,3des-cbc,blowfish-cbc,aes192-ctr,aes192-cbc,aes256-ctr,aes256-cbc");
configuration.put("kex", "diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256");

Session session = jsch.getSession(user , host, port);
session.setPassword(pwd);
session.setConfig(configuration);

System.out.println("------------------>Establishing Connection...");
session.connect();
System.out.println("------------------>Connection established.");
System.out.println("------------------>Creating SFTP Channel.");
ChannelSftp sftpChannel = (ChannelSftp) session.openChannel("sftp");
sftpChannel.connect();
System.out.println("------------------>SFTP Channel created.");

Expected - The connection should be made successfully to the server

Note - I tried including all the configuration methods which were described in various other posts here but nothing worked.

Actual - Getting the below error -

    com.jcraft.jsch.JSchException: Algorithm negotiation fail
    at com.jcraft.jsch.Session.receive_kexinit(Session.java:590)
    at com.jcraft.jsch.Session.connect(Session.java:320)
    at com.jcraft.jsch.Session.connect(Session.java:183)
    at FunctionLib.StoreAllRecordsFromLOCAL_IntoRequestList_Test(FunctionLib.java:38)
    at TestJunit.testConnectivity(TestJunit.java:21)
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    at java.lang.reflect.Method.invoke(Method.java:498)
    at org.junit.runners.model.FrameworkMethod$1.runReflectiveCall(FrameworkMethod.java:50)
    at org.junit.internal.runners.model.ReflectiveCallable.run(ReflectiveCallable.java:12)
    at org.junit.runners.model.FrameworkMethod.invokeExplosively(FrameworkMethod.java:47)
    at org.junit.internal.runners.statements.InvokeMethod.evaluate(InvokeMethod.java:17)
    at org.junit.runners.ParentRunner.runLeaf(ParentRunner.java:325)
    at org.junit.runners.BlockJUnit4ClassRunner.runChild(BlockJUnit4ClassRunner.java:78)
    at org.junit.runners.BlockJUnit4ClassRunner.runChild(BlockJUnit4ClassRunner.java:57)
    at org.junit.runners.ParentRunner$3.run(ParentRunner.java:290)
    at org.junit.runners.ParentRunner$1.schedule(ParentRunner.java:71)
    at org.junit.runners.ParentRunner.runChildren(ParentRunner.java:288)
    at org.junit.runners.ParentRunner.access$000(ParentRunner.java:58)
    at org.junit.runners.ParentRunner$2.evaluate(ParentRunner.java:268)
    at org.junit.runners.ParentRunner.run(ParentRunner.java:363)
    at org.eclipse.jdt.internal.junit4.runner.JUnit4TestReference.run(JUnit4TestReference.java:50)
    at org.eclipse.jdt.internal.junit.runner.TestExecution.run(TestExecution.java:38)
    at org.eclipse.jdt.internal.junit.runner.RemoteTestRunner.runTests(RemoteTestRunner.java:467)
    at org.eclipse.jdt.internal.junit.runner.RemoteTestRunner.runTests(RemoteTestRunner.java:683)
    at org.eclipse.jdt.internal.junit.runner.RemoteTestRunner.run(RemoteTestRunner.java:390)
    at org.eclipse.jdt.internal.junit.runner.RemoteTestRunner.main(RemoteTestRunner.java:197)

Log file:

INFO: CheckCiphers: aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-ctr,arcfour,arcfour128,arcfour256
INFO: aes256-ctr is not available.
INFO: aes192-ctr is not available.
INFO: aes256-cbc is not available.
INFO: aes192-cbc is not available.
INFO: CheckKexes: diffie-hellman-group14-sha1,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521
INFO: CheckSignatures: ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521
INFO: SSH_MSG_KEXINIT sent
INFO: SSH_MSG_KEXINIT received
INFO: kex: server: diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group14-sha256@ssh.com,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256
INFO: kex: server: ssh-rsa,ssh-rsa-sha256@ssh.com
INFO: kex: server: aes256-cbc,seed-cbc@ssh.com,crypticore128@ssh.com
INFO: kex: server: aes256-cbc,seed-cbc@ssh.com,crypticore128@ssh.com
INFO: kex: server: hmac-sha1,hmac-md5,crypticore-mac@ssh.com
INFO: kex: server: hmac-sha1,hmac-md5,crypticore-mac@ssh.com
INFO: kex: server: none,zlib
INFO: kex: server: none,zlib
INFO: kex: server: 
INFO: kex: server: 
INFO: kex: client: diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256
INFO: kex: client: ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521
INFO: kex: client: aes128-ctr,aes128-cbc,3des-ctr,3des-cbc,blowfish-cbc
INFO: kex: client: aes128-ctr,aes128-cbc,3des-ctr,3des-cbc,blowfish-cbc
INFO: kex: client: hmac-md5,hmac-sha1,hmac-sha2-256,hmac-sha1-96,hmac-md5-96
INFO: kex: client: hmac-md5,hmac-sha1,hmac-sha2-256,hmac-sha1-96,hmac-md5-96
INFO: kex: client: none
INFO: kex: client: none
INFO: kex: client: 
INFO: kex: client: 
INFO: Disconnecting from 10.92.155.57 port 22

Logs when run using Wifi - (Connection is established successfully) -

Dec 12, 2017 6:14:35 PM FunctionLib$MyJSchLogger log
INFO: Connecting to 10.92.155.6 port 22
Dec 12, 2017 6:14:35 PM FunctionLib$MyJSchLogger log
INFO: Connection established
Dec 12, 2017 6:14:35 PM FunctionLib$MyJSchLogger log
INFO: Remote version string: SSH-2.0-6.4.10.264 SSH Tectia Server
Dec 12, 2017 6:14:35 PM FunctionLib$MyJSchLogger log
INFO: Local version string: SSH-2.0-JSCH-0.1.54
Dec 12, 2017 6:14:35 PM FunctionLib$MyJSchLogger log
INFO: CheckCiphers: aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-ctr,arcfour,arcfour128,arcfour256
Dec 12, 2017 6:14:36 PM FunctionLib$MyJSchLogger log
INFO: aes256-ctr is not available.
Dec 12, 2017 6:14:36 PM FunctionLib$MyJSchLogger log
INFO: aes192-ctr is not available.
Dec 12, 2017 6:14:36 PM FunctionLib$MyJSchLogger log
INFO: aes256-cbc is not available.
Dec 12, 2017 6:14:36 PM FunctionLib$MyJSchLogger log
INFO: aes192-cbc is not available.
Dec 12, 2017 6:14:36 PM FunctionLib$MyJSchLogger log
INFO: CheckKexes: diffie-hellman-group14-sha1,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521
Dec 12, 2017 6:14:37 PM FunctionLib$MyJSchLogger log
INFO: CheckSignatures: ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521
Dec 12, 2017 6:14:37 PM FunctionLib$MyJSchLogger log
INFO: SSH_MSG_KEXINIT sent
Dec 12, 2017 6:14:37 PM FunctionLib$MyJSchLogger log
INFO: SSH_MSG_KEXINIT received
Dec 12, 2017 6:14:37 PM FunctionLib$MyJSchLogger log
INFO: kex: server: diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group14-sha256@ssh.com,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256
Dec 12, 2017 6:14:37 PM FunctionLib$MyJSchLogger log
INFO: kex: server: ssh-rsa,ssh-rsa-sha256@ssh.com
Dec 12, 2017 6:14:37 PM FunctionLib$MyJSchLogger log
INFO: kex: server: crypticore128@ssh.com,aes128-cbc,aes128-ctr,aes192-cbc,aes192-ctr,aes256-cbc,aes256-ctr,3des-cbc
Dec 12, 2017 6:14:37 PM FunctionLib$MyJSchLogger log
INFO: kex: server: crypticore128@ssh.com,aes128-cbc,aes128-ctr,aes192-cbc,aes192-ctr,aes256-cbc,aes256-ctr,3des-cbc
Dec 12, 2017 6:14:37 PM FunctionLib$MyJSchLogger log
INFO: kex: server: crypticore-mac@ssh.com,hmac-sha1,hmac-sha1-96,hmac-sha2-256,hmac-sha256-2@ssh.com,hmac-sha224@ssh.com,hmac-sha256@ssh.com,hmac-sha384@ssh.com,hmac-sha2-512,hmac-sha512@ssh.com
Dec 12, 2017 6:14:37 PM FunctionLib$MyJSchLogger log
INFO: kex: server: crypticore-mac@ssh.com,hmac-sha1,hmac-sha1-96,hmac-sha2-256,hmac-sha256-2@ssh.com,hmac-sha224@ssh.com,hmac-sha256@ssh.com,hmac-sha384@ssh.com,hmac-sha2-512,hmac-sha512@ssh.com
Dec 12, 2017 6:14:37 PM FunctionLib$MyJSchLogger log
INFO: kex: server: none,zlib
Dec 12, 2017 6:14:37 PM FunctionLib$MyJSchLogger log
INFO: kex: server: none,zlib
Dec 12, 2017 6:14:37 PM FunctionLib$MyJSchLogger log
INFO: kex: server: 
Dec 12, 2017 6:14:37 PM FunctionLib$MyJSchLogger log
INFO: kex: server: 
Dec 12, 2017 6:14:37 PM FunctionLib$MyJSchLogger log
INFO: kex: client: ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1
Dec 12, 2017 6:14:37 PM FunctionLib$MyJSchLogger log
INFO: kex: client: ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521
Dec 12, 2017 6:14:37 PM FunctionLib$MyJSchLogger log
INFO: kex: client: aes128-ctr,aes128-cbc,3des-ctr,3des-cbc,blowfish-cbc
Dec 12, 2017 6:14:37 PM FunctionLib$MyJSchLogger log
INFO: kex: client: aes128-ctr,aes128-cbc,3des-ctr,3des-cbc,blowfish-cbc
Dec 12, 2017 6:14:37 PM FunctionLib$MyJSchLogger log
INFO: kex: client: hmac-md5,hmac-sha1,hmac-sha2-256,hmac-sha1-96,hmac-md5-96
Dec 12, 2017 6:14:37 PM FunctionLib$MyJSchLogger log
INFO: kex: client: hmac-md5,hmac-sha1,hmac-sha2-256,hmac-sha1-96,hmac-md5-96
Dec 12, 2017 6:14:37 PM FunctionLib$MyJSchLogger log
INFO: kex: client: none
Dec 12, 2017 6:14:37 PM FunctionLib$MyJSchLogger log
INFO: kex: client: none
Dec 12, 2017 6:14:37 PM FunctionLib$MyJSchLogger log
INFO: kex: client: 
Dec 12, 2017 6:14:37 PM FunctionLib$MyJSchLogger log
INFO: kex: client: 
Dec 12, 2017 6:14:37 PM FunctionLib$MyJSchLogger log
INFO: kex: server->client aes128-ctr hmac-sha1 none
Dec 12, 2017 6:14:37 PM FunctionLib$MyJSchLogger log
INFO: kex: client->server aes128-ctr hmac-sha1 none
Dec 12, 2017 6:14:37 PM FunctionLib$MyJSchLogger log
INFO: SSH_MSG_KEXDH_INIT sent
Dec 12, 2017 6:14:37 PM FunctionLib$MyJSchLogger log
INFO: expecting SSH_MSG_KEXDH_REPLY
Dec 12, 2017 6:14:37 PM FunctionLib$MyJSchLogger log
INFO: ssh_rsa_verify: signature true
Dec 12, 2017 6:14:37 PM FunctionLib$MyJSchLogger log
WARNING: Permanently added '10.92.155.6' (RSA) to the list of known hosts.
Dec 12, 2017 6:14:37 PM FunctionLib$MyJSchLogger log
INFO: SSH_MSG_NEWKEYS sent
Dec 12, 2017 6:14:37 PM FunctionLib$MyJSchLogger log
INFO: SSH_MSG_NEWKEYS received
Dec 12, 2017 6:14:37 PM FunctionLib$MyJSchLogger log
INFO: SSH_MSG_SERVICE_REQUEST sent
Dec 12, 2017 6:14:37 PM FunctionLib$MyJSchLogger log
INFO: SSH_MSG_SERVICE_ACCEPT received
Dec 12, 2017 6:14:37 PM FunctionLib$MyJSchLogger log
INFO: Authentications that can continue: publickey,keyboard-interactive,password
Dec 12, 2017 6:14:37 PM FunctionLib$MyJSchLogger log
INFO: Next authentication method: publickey
Dec 12, 2017 6:14:37 PM FunctionLib$MyJSchLogger log
INFO: Authentications that can continue: password
Dec 12, 2017 6:14:37 PM FunctionLib$MyJSchLogger log
INFO: Next authentication method: password
Dec 12, 2017 6:14:37 PM FunctionLib$MyJSchLogger log
INFO: Authentication succeeded (password).

Logs when run using LAN - (Connection NOT established) -

Dec 12, 2017 6:12:36 PM FunctionLib$MyJSchLogger log
INFO: Connecting to 10.92.155.6 port 22
Dec 12, 2017 6:12:36 PM FunctionLib$MyJSchLogger log
INFO: Connection established
Dec 12, 2017 6:12:36 PM FunctionLib$MyJSchLogger log
INFO: Remote version string: SSH-2.0-6.4.10.264 SSH Tectia Server
Dec 12, 2017 6:12:36 PM FunctionLib$MyJSchLogger log
INFO: Local version string: SSH-2.0-JSCH-0.1.54
Dec 12, 2017 6:12:36 PM FunctionLib$MyJSchLogger log
INFO: CheckCiphers: aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-ctr,arcfour,arcfour128,arcfour256
Dec 12, 2017 6:12:37 PM FunctionLib$MyJSchLogger log
INFO: aes256-ctr is not available.
Dec 12, 2017 6:12:37 PM FunctionLib$MyJSchLogger log
INFO: aes192-ctr is not available.
Dec 12, 2017 6:12:37 PM FunctionLib$MyJSchLogger log
INFO: aes256-cbc is not available.
Dec 12, 2017 6:12:37 PM FunctionLib$MyJSchLogger log
INFO: aes192-cbc is not available.
Dec 12, 2017 6:12:37 PM FunctionLib$MyJSchLogger log
INFO: CheckKexes: diffie-hellman-group14-sha1,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521
Dec 12, 2017 6:12:38 PM FunctionLib$MyJSchLogger log
INFO: CheckSignatures: ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521
Dec 12, 2017 6:12:38 PM FunctionLib$MyJSchLogger log
INFO: SSH_MSG_KEXINIT sent
Dec 12, 2017 6:12:38 PM FunctionLib$MyJSchLogger log
INFO: SSH_MSG_KEXINIT received
Dec 12, 2017 6:12:38 PM FunctionLib$MyJSchLogger log
INFO: kex: server: diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group14-sha256@ssh.com,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256
Dec 12, 2017 6:12:38 PM FunctionLib$MyJSchLogger log
INFO: kex: server: ssh-rsa,ssh-rsa-sha256@ssh.com
Dec 12, 2017 6:12:38 PM FunctionLib$MyJSchLogger log
INFO: kex: server: aes256-cbc,seed-cbc@ssh.com,crypticore128@ssh.com
Dec 12, 2017 6:12:38 PM FunctionLib$MyJSchLogger log
INFO: kex: server: aes256-cbc,seed-cbc@ssh.com,crypticore128@ssh.com
Dec 12, 2017 6:12:38 PM FunctionLib$MyJSchLogger log
INFO: kex: server: hmac-sha1,hmac-md5,crypticore-mac@ssh.com
Dec 12, 2017 6:12:38 PM FunctionLib$MyJSchLogger log
INFO: kex: server: hmac-sha1,hmac-md5,crypticore-mac@ssh.com
Dec 12, 2017 6:12:38 PM FunctionLib$MyJSchLogger log
INFO: kex: server: none,zlib
Dec 12, 2017 6:12:38 PM FunctionLib$MyJSchLogger log
INFO: kex: server: none,zlib
Dec 12, 2017 6:12:38 PM FunctionLib$MyJSchLogger log
INFO: kex: server: 
Dec 12, 2017 6:12:38 PM FunctionLib$MyJSchLogger log
INFO: kex: server: 
Dec 12, 2017 6:12:38 PM FunctionLib$MyJSchLogger log
INFO: kex: client: ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1
Dec 12, 2017 6:12:38 PM FunctionLib$MyJSchLogger log
INFO: kex: client: ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521
Dec 12, 2017 6:12:38 PM FunctionLib$MyJSchLogger log
INFO: kex: client: aes128-ctr,aes128-cbc,3des-ctr,3des-cbc,blowfish-cbc
Dec 12, 2017 6:12:38 PM FunctionLib$MyJSchLogger log
INFO: kex: client: aes128-ctr,aes128-cbc,3des-ctr,3des-cbc,blowfish-cbc
Dec 12, 2017 6:12:38 PM FunctionLib$MyJSchLogger log
INFO: kex: client: hmac-md5,hmac-sha1,hmac-sha2-256,hmac-sha1-96,hmac-md5-96
Dec 12, 2017 6:12:38 PM FunctionLib$MyJSchLogger log
INFO: kex: client: hmac-md5,hmac-sha1,hmac-sha2-256,hmac-sha1-96,hmac-md5-96
Dec 12, 2017 6:12:38 PM FunctionLib$MyJSchLogger log
INFO: kex: client: none
Dec 12, 2017 6:12:38 PM FunctionLib$MyJSchLogger log
INFO: kex: client: none
Dec 12, 2017 6:12:38 PM FunctionLib$MyJSchLogger log
INFO: kex: client: 
Dec 12, 2017 6:12:38 PM FunctionLib$MyJSchLogger log
INFO: kex: client: 
Dec 12, 2017 6:12:38 PM FunctionLib$MyJSchLogger log
INFO: Disconnecting from 10.92.155.6 port 22

Hi Martin, Already I am using JSch version - 0.1.54, is there any other version latest to this? — Johnny, Dec 05 '17 at 08:57
Martin, Can please help to tell me how to get the logs that you are requesting for? — Johnny, Dec 05 '17 at 09:08
Can please elaborate on where in my code i need to fit this IN ? as i am facing multiple errors from eclipse itself. Do i need to copy paste your code in a separate (.java)file or how? — Johnny, Dec 05 '17 at 09:44
Hi Martin, I have posted my findings based on the code given by you below. — Johnny, Dec 06 '17 at 03:01
I've appended your log already, so do not add it again. + Your question is duplicate, follow the link above. And please accept that your question is duplicate. — Martin Prikryl, Dec 06 '17 at 07:21
How to accept that my question is duplicate of the other one? — Johnny, Dec 06 '17 at 09:59
There should be a button for that above or below your question. — Martin Prikryl, Dec 06 '17 at 10:01
Hi Martin, Noticed that, I am getting the above connectivity issue only when i am connected via LAN. However I am able to establish a connection successfully through the same code when connected via Wi-fi. Any potential reasons for this? — Johnny, Dec 12 '17 at 09:43
By "connectivity issue" you you mean the "Algorithm negotiation fail"? — Martin Prikryl, Dec 12 '17 at 09:45
Yes if I am connected to the LAN then i get this "Algorithm negotiation fail" error. If not then it is getting connected successfully thru wifi. — Johnny, Dec 12 '17 at 10:06
As you can see, the server offers different algorithms in the "wifi" log than in the "lan" log. Either you are not really connecting to the same server. Or the server offers different algorithms based on a network interface or an IP address. — Martin Prikryl, Dec 12 '17 at 10:36
Martin, Is it possible to alter anything in the configuration on our local(i.e. client side) so that it matches the algorithm which the server is using when connected in LAN and could establish a connection successfully after ? — Johnny, Dec 13 '17 at 02:14
You cannot use an algorithm, if the server does not offer it. There's nothing you can do on a client side, if you are sure that you connect to the correct server (note that it's strange that the server would offer different algorithms to different clients, so I'm still not ruling out possibility, that you are doing some mistake, like connecting to a wrong server). — Martin Prikryl, Dec 13 '17 at 06:22
Thanks Martin, The issue is now resolved. After placing the necessary policy files in place inside the lib/security folder. Thanks for all your time on this. — Johnny, Dec 13 '17 at 06:36

score -1 · Answer 1 · answered Dec 13 '17 at 09:46

-1

For the above mentioned issue, I did the following -

Updated the below - Java - 1.8.151 Eclipse - Oxygen

And after installing the JDK I updated the policy files (local_policy.jar & US_export_policy.jar) present in folderC:/ProgramFiles/Java/jre1.8.151/jre/lib/security/ with this file --> Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy Files 8

The link to download the file is already mentioned in one of the comments above.

answered Dec 13 '17 at 09:46

Johnny

11
1
4

OK, I've thought that you did something about the LAN/wifi. But you didn't, you did what I've suggested you from the vary beginning, by pointing you to the duplicate question. No point re-posting the same solution. Please accept that you question is duplicate, instead of duplicating an answer. – Martin Prikryl Dec 13 '17 at 10:03

Getting Algorithm negotiation fail while trying to connect to sftp server using Jsch in java

1 Answers1