<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;"><div>You’ll need to upgrade to the latest release, 1.10, which supports ed-25519 and ecdsa keys. The main branch also supports upgrading RSA key encryption if your sever supports it.</div><div><br></div><div>Will</div><br><div><br><blockquote type="cite"><div>On Apr 3, 2023, at 7:27 AM, Richard Beppel via libssh2-devel <libssh2-devel@lists.haxx.se> wrote:</div><br class="Apple-interchange-newline"><div><div><div class="yahoo-style-wrap" style="font-family:Helvetica Neue, Helvetica, Arial, sans-serif;font-size:16px;"><div dir="ltr" data-setdir="false">Hi,</div><div dir="ltr" data-setdir="false"><br></div><div dir="ltr" data-setdir="false">I am working on a RHEL-7 system that uses libssh2 to perform file transfers to a remote server. The current remote server uses the RHEL-7 OS and the file transfers work as expected. However the remote server is being upgraded to the RHEL-9 OS and must now operate in FIPS mode.</div><div dir="ltr" data-setdir="false"><br></div><div dir="ltr" data-setdir="false">Integration testing has uncovered an issue with the libssh2_session_handshake function. When this function executes it fails. The log file in the remote RHEL-9 server provides the following error message:</div><div dir="ltr" data-setdir="false"><br></div><div dir="ltr" data-setdir="false"><br></div><div dir="ltr" data-setdir="false"><span>"Unable to negotiate with 192.168.1.130 port 54316: no matching host key type found. Their offer: ssh-rsa,ssh-dss [preauth]"</span></div><div dir="ltr" data-setdir="false"><span><br></span></div><div dir="ltr" data-setdir="false"><span><br></span></div><div dir="ltr" data-setdir="false"><span>The exchange is designed to happen with a public/private key pair. This key pair has been established between the two system. This key pair has been validated manually. For example, I can use the RHEL-7 command line to execute an "ssh" command to login to the remote RHEL-9 server without entering a password. I can also manually execute the "sftp" command to transfer a file to the remote RHEL-9 server without entering a password.</span></div><div dir="ltr" data-setdir="false"><span><br></span></div><div dir="ltr" data-setdir="false"><span>At this time the only way I can get the RHEL-7 client to transfer a file using the libssh2 library is by altering the RHEL-9 server configuration to the DEFAULT:SHA1 mode instead of the FIPS mode. However, this is not a viable solution due to customer requirements.<br></span></div><div dir="ltr" data-setdir="false"><span><br></span></div><div dir="ltr" data-setdir="false"><span>The RHEL-7 system is using the following libssh2 packages:</span></div><div dir="ltr" data-setdir="false"><div><ul><li>libssh2-devel-1.8.0-4.el7.x86_64</li><li>libssh2-1.8.0-4.el7.x86_64</li></ul><div dir="ltr" data-setdir="false">Is there anyway to alter the behavior of the libssh2 handshake process to send a host key type that is acceptable to the RHEL-9 server?</div><div dir="ltr" data-setdir="false"><br></div><div dir="ltr" data-setdir="false">Kind Regards</div><div dir="ltr" data-setdir="false"><br></div><div dir="ltr" data-setdir="false">Rick<br></div><div dir="ltr" data-setdir="false"><br></div><br></div></div></div></div>-- <br>libssh2-devel mailing list<br>libssh2-devel@lists.haxx.se<br>https://lists.haxx.se/mailman/listinfo/libssh2-devel<br></div></blockquote></div><br></body></html>