Error: Failed to establish SSH session as the algorithm negotiation failure

Products

• VMware SDDC Manager / VCF Installer
• VCF Operations

Issue/Introduction

• Configuration of SFTP backups in the SDDC Manager UI fails during the "Site Settings" save process. This failure occurs when the SDDC Manager cannot establish a secure SSH session with the target backup server (e.g., an AWS SFTP instance) due to incompatible cryptographic algorithms or ciphers.
• On the SDDC Manager UI - under Administration, Backup, Site Settings - the backup configuration fails to save.

A red banner error is displayed -

Failed to establish SSH session to #### as the algorithm negotiation failure ..... for the list of supported algorithms for SDDC Manager

The error below is observed in the log file /var/log/vmware/vcf/operationsmanager/operationsmanager.log

#### ERROR [vcf_om,####,####] [c.vmware.vcf.secure.ssh.SshExecuter,http-nio-127.0.0.1-7300-exec-8] ERROR MESSAGE Algorithm negotiation fail
#### ERROR [vcf_om,####,####] [c.vmware.vcf.secure.ssh.SshExecuter,http-nio-127.0.0.1-7300-exec-8] Authentication negotiation failed for host #### com.jcraft.jsch.JSchException: Algorithm negotiation fail

Unable to create jsch CLI session: com.jcraft.jsch.JSchException: Algorithm negotiation fail

 

Environment

• VCF 5.x
• VCF 9.0

Cause

• The SSH algorithms and ciphers presented by the target backup server (e.g., an AWS SFTP instance) do not satisfy the security requirements of the SDDC Manager. This mismatch prevents the successful establishment of an SSH session during the backup packaging and encryption phase.
• Mismatch in supported cryptographic algorithms or ciphers between SDDC Manager and the remote SFTP server.

Resolution

1. Remediate remote SFTP server with the Algorithms and Ciphers requirements
2. Validate the Backup configuration and verify the backups.
3. Modify Backup Site Settings to use FQDN instead of IP address. 
   1. In the SDDC Manager UI, navigate to Administration > Backup > Site Settings and Modify the Backup Server Address to use the FQDN instead of the IP address