One of our clients is attempting to start an SFTP session on our file transfer server. When they try to authenticate we see these errors in the auth.log.

Jan 16 11:24:34 ft sshd[6898]: error: kex protocol error: type 30 seq 1 [preauth]
Jan 16 11:24:34 ft sshd[6898]: error: Received disconnect from xxx.xxx.xxx.xxx port xxxxx:3: Expected SSH_MSG_KEX_GEX_GROUP [preauth]
Jan 16 11:24:34 ft sshd[6898]: Disconnected from xxx.xxx.xxx.xxx port xxxxx [preauth]

We can't figure out why this client cannot connect and all other clients can connect.

Versions: Ubuntu 16.04.1 LTS OpenSSH_7.2p2 Ubuntu-4ubuntu2.1 OpenSSL 1.0.2g

Edit: Forgot to mention the fact that our client can connect using their local machines, the issue is that their production server cannot connect. We have set up our sshd_config to permit all available KexAlgorithms and Ciphers as listed by man sshd_config.

I'm just trying to understand what exactly is failing. Is it their server failing to establish an SSH connection to begin the authentication process?

  • 1
    I suggest you increase the verbosity of your logs. You may also need to get them to increase the log verbosity on their side. – Zoredache Jan 18 '17 at 1:47
  • Try: ssh -vvv yourhostname to see why it is not connecting, this will print extra verbose messages which you can then examine to see why is server refusing connection. You may update your question with those so we can help you further. – Ivan Tomica Jan 18 '17 at 2:28
  • 2
    What ciphers does the SFTP client support? They are probably running old software and should update. – Dre Jan 18 '17 at 3:12
  • Everyone can connect on their local machines, but the client cannot connect using their production system. – John Saady Jan 18 '17 at 5:33
  • Some searches for "kex protocol error type 30 seq 1" turn up some interesting discussions on deprecated/removed OpenSSH support for a particular KexAlgorithm in 6.9; see here, and here. Perhaps the client SFTP software is requesting that old KexAlgorithm, which is no longer supported by your newer OpenSSH? – Castaglia Jan 18 '17 at 6:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.