Currently Online

Latest Posts

Topic: Getting sources fails with message "Unable to negotiate with <IP>"

QCS

Topic Opener
Joined: 2009-12-29, 21:47
Posts: 256
Ranking
Tribe Member
Posted at: 2015-11-07, 13:21

I just did an update to https://wl.widelands.org/wiki/Download/ wiki page regarding a topic coming up probably very soon in the wild:

Troubleshooting

If you have problems getting the sources, failing with a message like "Unable to negotiate with <IP>: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1": This is probably because you are using a new version of OpenSSH (>= 7.0), which has it disabled as default because of security reasons. You can add the following lines into your /etc/ssh/ssh_config or ~/.ssh/config file (on Linux at least, don't know about Windows or MacOS):

Host bazaar.launchpad.net
        KexAlgorithms +diffie-hellman-group1-sha1

This enables the old encryption method for the very specific host where Launchpad hosts its sources, while not allowing it for other hosts, thus not compromising your overall security too much. Hopefully, those guys at Launchpad are fixing the encryption soon.

Edited: 2015-11-07, 13:25

CMake is evil.

Top Quote
kaputtnik
Avatar
Joined: 2013-02-18, 19:48
Posts: 2442
OS: Archlinux
Version: current master
Ranking
One Elder of Players
Location: Germany
Posted at: 2015-11-07, 13:32

I ran into this for month...

Hopefully, those guys at Launchpad are fixing the encryption soon.

It seems that the launchpad developers couldn't fix this soon, because several third-party apps are involved: https://bugs.launchpad.net/launchpad/+bug/1445619/

So thanks for the wikiedit face-smile.png

Edit: Link to whole bug instead of one comment

Edited: 2015-11-07, 13:36

Fight simulator for Widelands:
https://wide-fighter.netlify.app/

Top Quote
kaputtnik
Avatar
Joined: 2013-02-18, 19:48
Posts: 2442
OS: Archlinux
Version: current master
Ranking
One Elder of Players
Location: Germany
Posted at: 2015-11-07, 13:47

Because i had also problems with uploading code i use this ~/.ssh/config :

Host *launchpad.net*
        KexAlgorithms +diffie-hellman-group1-sha1 

Fight simulator for Widelands:
https://wide-fighter.netlify.app/

Top Quote
QCS

Topic Opener
Joined: 2009-12-29, 21:47
Posts: 256
Ranking
Tribe Member
Posted at: 2015-11-07, 15:10

> *kaputtnik wrote:*
>
> Because i had also problems with uploading code i use this ~/.ssh/config :
>
> ~~~~
> Host *launchpad.net*
> KexAlgorithms +diffie-hellman-group1-sha1
> ~~~~
>
>

Please note that this config is kind of unsafe. Your Host directive matches bazaar.launchpad.net, but different DNS names as well:
- badhostlaunchpad.net (very dangerous, as it works with official DNS)
- launchpad.netbadhost (possible attack vector with manipulated DNS server in your network)

You should probably use:
> ~~~~
> Host *.launchpad.net
> KexAlgorithms +diffie-hellman-group1-sha1
> ~~~~

(note the . after the first asterisk and the missing second asterisk).


CMake is evil.

Top Quote
kaputtnik
Avatar
Joined: 2013-02-18, 19:48
Posts: 2442
OS: Archlinux
Version: current master
Ranking
One Elder of Players
Location: Germany
Posted at: 2015-11-07, 17:36

Thanks for clarification face-smile.png

I've not tested it yet but your suggestion would prevent uploading code to widelands-dev or to my user branches, wouldn't it?

What about:

Host *.launchpad.net/*
KexAlgorithms +diffie-hellman-group1-sha1

?


Fight simulator for Widelands:
https://wide-fighter.netlify.app/

Top Quote
QCS

Topic Opener
Joined: 2009-12-29, 21:47
Posts: 256
Ranking
Tribe Member
Posted at: 2015-11-07, 18:38

> *kaputtnik wrote:*
>
> What about:
> ~~~~
> Host *.launchpad.net/*
> KexAlgorithms +diffie-hellman-group1-sha1
> ~~~~
>
> ?

No. Please check the man page (5) of ssh_config (for example http://www.manpagez.com/man/5/ssh_config/ )

The Host directive is only for Hosts, not for anything resembling an URL (not that raw SSH can handle anything looking like URLs).
ssh_config is not about anything BZR related. BZR simply uses a connection it creates through utilizing ssh.

Edited: 2015-11-07, 18:39

CMake is evil.

Top Quote
kaputtnik
Avatar
Joined: 2013-02-18, 19:48
Posts: 2442
OS: Archlinux
Version: current master
Ranking
One Elder of Players
Location: Germany
Posted at: 2015-11-08, 21:44

Thanks again face-smile.png

I had several problems to do this setting, so i did some trial and error face-upset.png


Fight simulator for Widelands:
https://wide-fighter.netlify.app/

Top Quote
kaputtnik
Avatar
Joined: 2013-02-18, 19:48
Posts: 2442
OS: Archlinux
Version: current master
Ranking
One Elder of Players
Location: Germany
Posted at: 2015-11-16, 15:27

bazaar.launchpad.net should work now without editing the file ~/.ssh/config: https://bugs.launchpad.net/launchpad/+bug/1445619/comments/6


Fight simulator for Widelands:
https://wide-fighter.netlify.app/

Top Quote