配置rclone以支持diffie-hellman-group-exchange-sha256 diffie-hellman-group-exchange-sha1

Question

Some quick background. I use rclone to transfer data to a SFTP server. rclone is written in Golang and uses lib crypto under the hood. When we try to establish ssh connection to SFTP server, we get the error message

couldn't connect SSH: ssh: handshake failed: ssh: no common algorithm for key exchange; client offered: [[e-mail] ecdh-sha2-nistp256 ecdh-sha2-nistp384 ecdh-sha2-nistp521 diffie-hellman-group14-sha1 diffie-hellman-group1-sha1], server offered: [diffie-hellman-group-exchange-sha256 diffie-hellman-group-exchange-sha1].

crypto lib has added the support for diffie-hellman-group-exchange-sha256 diffie-hellman-group-exchange-sha1 around 3 weeks ago, but needs to be opt-in. (See https://github.com/golang/crypto/commit/57b3e21c3d5606066a87e63cfe07ec6b9f0db000)

Obviously, the latest rclone version hasn’t opt-in those algorithms support yet. So the question is: Anyone know how to config rclone to opt-in algorithm support for diffie-hellman-group-exchange-sha256 diffie-hellman-group-exchange-sha1

Answer 1

We have managed to opt-in those algorithms support and submitted a PR here: https://github.com/ncw/rclone/pull/3341

Note: since those algorithms are considered insecure, your also need to use the exisiting rclone flag --sftp-use-insecure-cipher to make them available for SSH handshake.