Logic App - SFTP SSH connector KeyExchangeFailed

sam57 16

We are using the sFTP SSH connector to connect to an external FTP server. When trying to connect, we get the error "The connection was closed by the server: No common host key algorithms. (KeyExchangeFailed)". According to the Azure documentation, the connector uses the SSH.NET library. Both the library and the FTP server support the "ssh-ed25519" Host Key algorithm.

Furthermore, if I use the SSH.NET nuget package locally, it just works. Same SSH key, same username, same server address.

So my question is: what version of SSH.NET is being used, and what properties/settings? Because there is probably a difference in the usage of the library.
If I'm not mistaken the source of the sFTP-SSH connector is not publically available, is it?

ChaitanyaNaykodi-MSFT 24,681 Reputation points Microsoft Employee

2020-12-03T21:15:31.397+00:00

Hello @sam57 , apologies for the delay. Yes you are correct "ssh-ed25519" Host Key algorithm is supported by the SSH.NET library, Can you please provide the key exchange method used? These are the supported key exchange methods supported. Apart from this just to be sure that there is no connectivity issue can you please have a look at the troubleshooting guideline and make sure that the IP associated with you Logic App region is in approved list if a firewall is set-up. Please let me know if this helps in resolving the issue or not? I will be glad to continue with our discussion.
sam57 16 Reputation points

2020-12-07T11:43:43.22+00:00

First of all, thank you for the reply.

But I am afraid that it doesn't help us much. We have checked and there is no firewall blocking the connection. If we enable the ssh-rsa host key algorithm, Azure does connect to the FTP server. If we switch to ssh-ed25519, Azure does not connect.
Again, when we run the code locally it works without a problem (using SSH.NET version 2020.0.0-beta1). What version of SSH.NET is Azure using? And are you disabling some algorithms in the SSH.NET library?

1 answer

ChaitanyaNaykodi-MSFT 24,681 Reputation points Microsoft Employee

2020-12-07T21:43:23.883+00:00

Hello @sam57 ,
My sincere apologies for not conveying this before, somehow I missed it. The "ssh-ed25519" host key algorithm is not supported by the SFTP-SSH connector even though it is supported by the SSH.NET library. The algorithm's currently supported are mentioned here. Regarding the exact version SSH.NET used, I have reached out to the team internally and will update this thread as soon as I have a response. Thank you! Please let me know if there are any additional concerns.
Please sign in to rate this answer.
sam57 16 Reputation points

2020-12-08T08:44:58.827+00:00

I could be wrong, but in the documentation you are providing I only see information about the private key types and encryption algorithms. Nothing about the host key types.

ChaitanyaNaykodi-MSFT 24,681 Reputation points Microsoft Employee

2020-12-09T00:16:33.27+00:00

Hello @sam57 , currently ssh-rsa and ssh-dss are the only supported host key algorithms, I will be updating the document shortly so that it is mentioned specifically. The connector is currently using the 2016.1.0 version of the SSH.NET library with the updates from May 2020.

sam57 16 Reputation points

2020-12-09T09:23:24.137+00:00

Is it possible to add the more secure host key algorithms of the SSH.NET library as well? Maybe in some preview version or something? We received a security audit, and our customers are prohibiting the use of ssh-rsa due to breaches. If not, we'll have to stop using Logic Apps and build our own code.

ChaitanyaNaykodi-MSFT 24,681 Reputation points Microsoft Employee

2020-12-09T23:54:49.133+00:00

Hello @sam57 , can you please raise this suggestion on our User Voice platform? the product groups use this platform to evaluate and implement any product improvements.
Sign in to comment

Share via

Logic App - SFTP SSH connector KeyExchangeFailed

1 answer