SSH_CONNECTION_FAILURE — MAC algorithm negotiation fails with OpenSSH 9.x on DiscoveryIssue <!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } Discovery fails for target Linux servers running OpenSSH 9.x, returning the error: "Cannot connect, status is SSH_CONNECTION_FAILURE. Could not agree on client-to-server MAC algorithm. Client: [hmac-sha2-256, hmac-sha1, hmac-sha2-512, hmac-sha1-96, hmac-md5-96, hmac-md5] Server: []". The target servers advertise only ETM (Encrypt-then-MAC) MAC algorithm variants, which the MID Server SSH library does not support. Hence, the SSH key exchange fails before authentication is reached. Release<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } ALL Cause<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } The MID Server SSH library advertises only legacy non-ETM MAC algorithms. OpenSSH 9.x servers advertise only ETM variants by default, reflecting a security hardening posture introduced progressively starting with OpenSSH 7.6+. Because neither side finds a common MAC algorithm during the KEXINIT phase, the session is torn down before authentication. This failure occurs at OSI layer 6 (Presentation layer), during the SSH key exchange (KEXINIT) phase. The Presentation layer handles data encryption, encoding, and protocol-level negotiation. In SSH, this is where cipher suites, MAC algorithms, and compression methods are agreed upon before any application data flows. OSI layerWhat happens / outcomeLayer 3 — NetworkIP routing; MID Server reaches targetLayer 4 — TransportTCP 3-way handshake completes on port 22 (confirmed in logs: TCP connected)Layer 5 — SessionSSH session channel opened; protocol version SSH-2.0 exchangedLayer 6 — PresentationKEXINIT exchanged — cipher, KEX, MAC, and compression algorithm lists compared. Failure occurs here.Layer 7 — ApplicationNever reached — session is torn down before authentication In SSH-2, the KEXINIT message is the first cryptographic negotiation packet. It carries ordered preference lists for key exchange, host key, cipher, MAC, and compression algorithms. Both peers must find a common algorithm in every category. If any category has zero overlap, the session is torn down before encryption starts. This is a Presentation layer function. Algorithm overlap analysis (from KEXINIT exchange) SideMAC algorithms advertisedMID Server (client)hmac-sha2-256, hmac-sha1, hmac-sha2-512, hmac-sha1-96, hmac-md5-96, hmac-md5Target server (SSH-2.0-OpenSSH_9.6)umac-128-etm@openssh.com, hmac-sha2-256-etm@openssh.com, hmac-sha2-512-etm@openssh.comOverlapNONE — negotiation fails Encrypt-then-MAC (ETM) computes the MAC over the ciphertext, which is cryptographically stronger than MAC-then-Encrypt, which computes the MAC over the plaintext. OpenSSH 9.x dropped non-ETM from its default advertised list, creating this compatibility gap with older SSH client libraries. Log evidence (agent.log): The following log entries confirm the failure sequence. # TCP layer succeeds (Layer 4) [SSHProtocolEngine] [26157/10.X.X.XXX:22] TCP connected # Client KEXINIT sent — non-ETM MACs offered [SSHProtocolEngine] Client-to-Server MAC Algorithms: hmac-sha2-256, hmac-sha1, hmac-sha2-512, hmac-sha1-96, hmac-md5-96, hmac-md5 # Server KEXINIT received — only ETM MACs, no overlap [SSHProtocolEngine] Server Client-to-Server MAC Algorithms: (empty) Remote advertises: umac-128-etm@openssh.com, hmac-sha2-256-etm@openssh.com, hmac-sha2-512-etm@openssh.com # Failure at Layer 6 (Presentation) [DefaultSecurityPolicy:60] MAC_CS could not be negotiated [SSHProtocolEngine] Session failure: Could not agree on client-to-server MAC algorithm # All dependent probes cascade-skipped (Layer 7 never reached) [MultiProbe:63] Skipping probe 'uname -a' since previous failure detected Timestamp: 2025-06-17 01:06:52+0800 | MID Server: <mid-server-name> | Target: 10.X.X.XXX:22 Resolution<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } This workaround re-enables non-ETM MAC algorithms on the target Linux server SSH daemon so that the MID Server offered algorithms overlap with the server advertised list. This has security implications — validate it with the infrastructure team before applying. Root or sudo-privileged access on the target server is required to complete the following steps. Step 1 — Edit sshd_config on the target server sudo vi /etc/ssh/sshd_config Add or modify the MACs directive to include the non-ETM algorithms the MID Server supports: MACs hmac-sha2-256,hmac-sha1,hmac-sha2-512,hmac-md5 Step 2 — Validate the configuration (optional but preferred) sudo sshd -t # No output = configuration is valid Step 3 — Restart the SSH service sudo systemctl restart sshd # Verify the service restarted cleanly sudo systemctl status sshd Step 4 — Verify the new MAC list is advertised. From any Linux host with network access to the target, run: ssh -vvv user@10.X.X.XXX 2>&1 | grep 'server MAC' # Expected: server MAC: hmac-sha2-256 (or similar non-ETM algorithm) Note: This workaround functions by adding non-ETM MACs to the sshd configuration. It should be validated with the infrastructure team, as it has security implications for the target server. Reference : MID Server SSH cryptographic algorithms