{"thread":{"id":"57796","subject":"Error after update from 2.31.1 -> 2.36: Unable to negotiate with IP port X: no matching host key type found.","startedAt":"2022-04-26T14:05:24Z","lastAt":"2022-04-27T06:05:17Z","messageCount":5,"participants":["Elektronik (C.Gerhardt GmbH & Co. KG)","Carlo Marcelo Arenas Belón","rsbecker@nexbridge.com","brian m. carlson"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"454432","messageId":"VI1PR05MB6495349A4C42AA568A665D7BCCFB9@VI1PR05MB6495.eurprd05.prod.outlook.com","threadId":"57796","inReplyTo":null,"subject":"Error after update from 2.31.1 -> 2.36: Unable to negotiate with IP port X: no matching host key type found.","fromName":"Elektronik (C.Gerhardt GmbH & Co. KG)","fromEmail":"elektronik@gerhardt.de","sentAt":"2022-04-26T14:05:14Z","receivedAt":"2022-04-26T14:05:24Z","isPatch":false,"sender":{"key":"elektronik@gerhardt.de","avatar":null},"body":"Hey at all, \n \ndon't know if this is the right way to report a bug although I read so in https://git-scm.com/community. Never used mailing lists before so I hope I am doing well... \n \nI found that after an update from git 2.31.1. to 2.36 the authentication to our git server (running gitea 1.13.1) fails. We are getting the following error: \n \n$ git clone ssh://git@192.168.101.69:4711/CG/DT_installer_script.git\nCloning into 'DT_installer_script'...\nUnable to negotiate with 192.168.101.69 port 4711: no matching host key type found. Their offer: ssh-rsa\nfatal: Could not read from remote repository.\n \nPlease make sure you have the correct access rights\nand the repository exists.\n \nThe SSH keys were generated with Puttygen, converted to openSSH format and are stored in c:\\users\\USER\\.ssh\\\nThe keys have not been changed after the update. \n \nWith Version 2.31.1 it is working fine but after upgrading to 2.36 I get the above error. \nAm I doing something wrong or is this a buggy behaviour? \nOS: Win 10\n \nBest regards, \n \n\ni.A. Stefan Mayrhofer \nC. Gerhardt GmbH & Co. KG \nCäsariusstraße 97 \nD-53639 Königswinter \n\nTel.: +49 2223 2999 513 \nFax: +49 2223 2999 99 \nMail: mailto:elektronik@gerhardt.deWeb: https://www.gerhardt.de\n   \n----------------------------------------------------------------------------------- \nPersönlich haftende Gesellschafter: Dr. Macke GmbH, Königswinter - Vertretungsberechtigte Geschäftsführer: Jan Macke, Tom Macke \nRegistergericht: Amtsgericht Siegburg - Registernummer: HRA4275 - WEEE: Reg.-Nr. DE 54940101 \n\nAus Rechts- und Sicherheitsgruenden ist die in dieser E-Mail gegebene Information nicht rechtsverbindlich. Eine rechtsverbindliche Bestaetigung reichen wir Ihnen gerne auf Anforderung in schriftlicher Form nach.Beachten Sie bitte, dass jede Form der unautorisierten Nutzung, Veroeffentlichung, Vervielfaeltigung oder Weitergabe des Inhalts dieser E-Mail nicht gestattet ist. Diese Nachricht ist ausschliesslich fuer den bezeichneten Adressaten oder dessen Vertreter bestimmt. Sollten Sie nicht der vorgesehene Adressat dieser E-Mail oder dessen Vertreter sein, so bitten wir Sie, sich mit dem Absender der E-Mail in Verbindung zu setzen. \nFor legal and security reasons the information provided in this e-mail is not legally binding. Upon request we would be pleased to provide you with a legally binding confirmation in written form. Any form of unauthorised use, publication, reproduction, copying or disclosure of the content of this email is not permitted. This message is exclusively for the person addressed or their representative. If you are not the intended recipient of this message and its contents, please notify the sender immediately. \n"},{"id":"454433","messageId":"20220426144914.nyaohjqqqlotxnnm@carlos-mbp.lan","threadId":"57796","inReplyTo":"VI1PR05MB6495349A4C42AA568A665D7BCCFB9@VI1PR05MB6495.eurprd05.prod.outlook.com","subject":"Re: Error after update from 2.31.1 -> 2.36: Unable to negotiate with IP port X: no matching host key type found.","fromName":"Carlo Marcelo Arenas Belón","fromEmail":"carenas@gmail.com","sentAt":"2022-04-26T14:49:14Z","receivedAt":"2022-04-26T14:49:21Z","isPatch":false,"sender":{"key":"carenas@gmail.com","avatar":"https://avatars.githubusercontent.com/u/76036?v=4"},"body":"On Tue, Apr 26, 2022 at 02:05:14PM +0000, Elektronik (C.Gerhardt GmbH & Co. KG) wrote:\n>  \n> I found that after an update from git 2.31.1. to 2.36 the authentication to our git server (running gitea 1.13.1) fails. We are getting the following error: \n\nI am guessing the issue might be the one documented in the following git for\nwindows issue:\n\n https://github.com/git-for-windows/git/issues/3468\n\nThe problem is not with git (neither a git for windows) specific issue, but\nwith the underlying version of openssh that is used in your server and the\nbest course of option is to upgrade that and generate a new host key, but\nthere are other options shown in that ticket that might help in the meanwhile.\n\nCarlo\n"},{"id":"454444","messageId":"049d01d85985$9ffe3870$dffaa950$@nexbridge.com","threadId":"57796","inReplyTo":"20220426144914.nyaohjqqqlotxnnm@carlos-mbp.lan","subject":"RE: Error after update from 2.31.1 -> 2.36: Unable to negotiate with IP port X: no matching host key type found.","fromName":"","fromEmail":"rsbecker@nexbridge.com","sentAt":"2022-04-26T15:52:20Z","receivedAt":"2022-04-26T15:52:32Z","isPatch":false,"sender":{"key":"randall.becker@nexbridge.ca","avatar":"https://avatars.githubusercontent.com/u/28956764?v=4"},"body":"On April 26, 2022 10:49 AM, Carlo Marcelo Arenas Belón wrote:\n>On Tue, Apr 26, 2022 at 02:05:14PM +0000, Elektronik (C.Gerhardt GmbH & Co. KG)\n>wrote:\n>>\n>> I found that after an update from git 2.31.1. to 2.36 the authentication to our git\n>server (running gitea 1.13.1) fails. We are getting the following error:\n>\n>I am guessing the issue might be the one documented in the following git for\n>windows issue:\n>\n> https://github.com/git-for-windows/git/issues/3468\n>\n>The problem is not with git (neither a git for windows) specific issue, but with the\n>underlying version of openssh that is used in your server and the best course of\n>option is to upgrade that and generate a new host key, but there are other\n>options shown in that ticket that might help in the meanwhile.\n\nI noticed this prior to 2.36.0, so I do no think it is related to git. Switching OpenSSH versions triggered this situation.\n\n"},{"id":"454476","messageId":"YmhjBBlJ5mcI31uN@camp.crustytoothpaste.net","threadId":"57796","inReplyTo":"20220426144914.nyaohjqqqlotxnnm@carlos-mbp.lan","subject":"Re: Error after update from 2.31.1 -> 2.36: Unable to negotiate with IP port X: no matching host key type found.","fromName":"brian m. carlson","fromEmail":"sandals@crustytoothpaste.net","sentAt":"2022-04-26T21:24:20Z","receivedAt":"2022-04-26T21:24:29Z","isPatch":false,"sender":{"key":"sandals@crustytoothpaste.net","avatar":"https://avatars.githubusercontent.com/u/497054?v=4"},"body":"On 2022-04-26 at 14:49:14, Carlo Marcelo Arenas Belón wrote:\n> On Tue, Apr 26, 2022 at 02:05:14PM +0000, Elektronik (C.Gerhardt GmbH & Co. KG) wrote:\n> >  \n> > I found that after an update from git 2.31.1. to 2.36 the authentication to our git server (running gitea 1.13.1) fails. We are getting the following error: \n> \n> I am guessing the issue might be the one documented in the following git for\n> windows issue:\n> \n> https://github.com/git-for-windows/git/issues/3468\n> \n> The problem is not with git (neither a git for windows) specific issue, but\n> with the underlying version of openssh that is used in your server and the\n> best course of option is to upgrade that and generate a new host key, but\n> there are other options shown in that ticket that might help in the meanwhile.\n\nYes, the error message you're seeing indicates that your version of\nOpenSSH, which is used by Git for Windows, has disabled the insecure\nssh-rsa signature algorithm. Keys using the ssh-rsa key type, which can\nuse ssh-rsa as the signature algorithm or the secure rsa-sha2-256 and\nrsa-sha2-512, can continue to be used if you support the new signature\ntypes.\n\nThe problem is that Gitea uses the Go SSH library, which inherits this\nproblem. Gitea is tracking this as [0]. The easiest way to solve this\nwould be to add a host key that is Ed25519, which won't have the same\nproblem.\n\nThe issue I mentioned above also has a workaround to re-enable the\nssh-rsa signature type if you can't do that, but of course that's\ninsecure.\n\n[0] https://github.com/go-gitea/gitea/issues/17798\n-- \nbrian m. carlson (he/him or they/them)\nToronto, Ontario, CA\n"},{"id":"454486","messageId":"VI1PR05MB6495B06E933B4D793B0EFD5FCCFA9@VI1PR05MB6495.eurprd05.prod.outlook.com","threadId":"57796","inReplyTo":"YmhjBBlJ5mcI31uN@camp.crustytoothpaste.net","subject":"AW: Error after update from 2.31.1 -> 2.36: Unable to negotiate with IP port X: no matching host key type found.","fromName":"Elektronik (C.Gerhardt GmbH & Co. KG)","fromEmail":"elektronik@gerhardt.de","sentAt":"2022-04-27T06:05:09Z","receivedAt":"2022-04-27T06:05:17Z","isPatch":false,"sender":{"key":"elektronik@gerhardt.de","avatar":null},"body":"Thanks for the responses and explanations. I have understood that the old ssh-rsa is deprecated and will update to the new certificates and current git release by next week. Until then we'll keep the older 2.31 version so that I can work for now. As the server is located in our local network that is no big security issue.\n\nBest regards, \n\ni.A. Stefan Mayrhofer \nC. Gerhardt GmbH & Co. KG \nCäsariusstraße 97 \nD-53639 Königswinter \n\nTel.: +49 2223 2999 513 \nFax: +49 2223 2999 99 \nMail: elektronik@gerhardt.de \nWeb: www.gerhardt.de \n----------------------------------------------------------------------------------- \nPersönlich haftende Gesellschafterin: Dr. Macke GmbH, Königswinter - Vertretungsberechtigte Geschäftsführer: Jan Macke, Tom Macke \nRegistergericht: Amtsgericht Siegburg - Registernummer: HRA4275 - WEEE: Reg.-Nr. DE 54940101 \n\nAus Rechts- und Sicherheitsgruenden ist die in dieser E-Mail gegebene Information nicht rechtsverbindlich. Eine rechtsverbindliche Bestaetigung reichen wir Ihnen gerne auf Anforderung in schriftlicher Form nach.Beachten Sie bitte, dass jede Form der unautorisierten Nutzung, Veroeffentlichung, Vervielfaeltigung oder Weitergabe des Inhalts dieser E-Mail nicht gestattet ist. Diese Nachricht ist ausschliesslich fuer den bezeichneten Adressaten oder dessen Vertreter bestimmt. Sollten Sie nicht der vorgesehene Adressat dieser E-Mail oder dessen Vertreter sein, so bitten wir Sie, sich mit dem Absender der E-Mail in Verbindung zu setzen. \nFor legal and security reasons the information provided in this e-mail is not legally binding. Upon request we would be pleased to provide you with a legally binding confirmation in written form. Any form of unauthorised use, publication, reproduction, copying or disclosure of the content of this email is not permitted. This message is exclusively for the person addressed or their representative. If you are not the intended recipient of this message and its contents, please notify the sender immediately. \n-----Ursprüngliche Nachricht-----\nVon: brian m. carlson \nGesendet: Dienstag, 26. April 2022 23:24\nAn: Carlo Marcelo Arenas Belón \nCc: Elektronik (C.Gerhardt GmbH & Co. KG) ; git@vger.kernel.org; CRM (C.Gerhardt GmbH & Co. KG) \nBetreff: Re: Error after update from 2.31.1 -> 2.36: Unable to negotiate with IP port X: no matching host key type found.\n\nOn 2022-04-26 at 14:49:14, Carlo Marcelo Arenas Belón wrote:\n> On Tue, Apr 26, 2022 at 02:05:14PM +0000, Elektronik (C.Gerhardt GmbH & Co. KG) wrote:\n> >  \n> > I found that after an update from git 2.31.1. to 2.36 the authentication to our git server (running gitea 1.13.1) fails. We are getting the following error: \n> \n> I am guessing the issue might be the one documented in the following git for\n> windows issue:\n> \n> https://github.com/git-for-windows/git/issues/3468\n> \n> The problem is not with git (neither a git for windows) specific issue, but\n> with the underlying version of openssh that is used in your server and the\n> best course of option is to upgrade that and generate a new host key, but\n> there are other options shown in that ticket that might help in the meanwhile.\n\nYes, the error message you're seeing indicates that your version of\nOpenSSH, which is used by Git for Windows, has disabled the insecure\nssh-rsa signature algorithm. Keys using the ssh-rsa key type, which can\nuse ssh-rsa as the signature algorithm or the secure rsa-sha2-256 and\nrsa-sha2-512, can continue to be used if you support the new signature\ntypes.\n\nThe problem is that Gitea uses the Go SSH library, which inherits this\nproblem. Gitea is tracking this as [0]. The easiest way to solve this\nwould be to add a host key that is Ed25519, which won't have the same\nproblem.\n\nThe issue I mentioned above also has a workaround to re-enable the\nssh-rsa signature type if you can't do that, but of course that's\ninsecure.\n\n[0] https://github.com/go-gitea/gitea/issues/17798\n-- \nbrian m. carlson (he/him or they/them)\nToronto, Ontario, CA\n"}]}