Troubleshooting 'Failed to Negotiate Algorithms' Alerts in SSH Monitoring

Failed to Negotiate Algorithms – Critical Alerts in SSH Mode

The "failed to negotiate algorithms" exception occurs when an SSH client and server cannot agree on a common cryptographic algorithm for secure communication. This prevents the SSH connection from being established.

When an SSH connection is initiated, both client and server exchange supported cryptographic algorithms, including:

Key Exchange Algorithms – Used to establish a secure connection.
Ciphers – Used for encrypting data.
Message Authentication Codes (MACs) – Ensure message integrity.

If there is no common algorithm between the Applications Manager SSH client and the monitored server, a failed to negotiate algorithms error occurs.

Troubleshooting Steps

Log in to the target server (monitored via SSH).
Open the SSH configuration file:
sudo vi /etc/ssh/sshd_config
Search for the Cipher, KexAlgorithm, and MACs directives.
Ensure these directives are not commented out (remove # if present) and note down the values listed for each directive.
In Applications Manager, navigate to Settings → Performance Polling → SSH Connection Settings
Locate the Allowed Ciphers, Key Exchanges, and MACs and compare these with the values from the target server.
If no common algorithm exists across the directives, a critical alert will be triggered.

Fixing the Issue

Option 1: Update Applications Manager SSH Settings

Enable the missing algorithms in Applications Manager's SSH settings (under the respective directive).
Restart Applications Manager for changes to take effect.

Option 2: Modify SSH Configuration on the Target Server

Create a backup of sshd_config before modifying it: sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config.bak

Open the SSH configuration file:
sudo vi /etc/ssh/sshd_config
Locate and update the following directives to match the supported algorithms in Applications Manager:
Ciphers aes128-ctr,aes192-ctr,aes256-ctr,chacha20-poly1305@openssh.com
MACs hmac-sha2-256,hmac-sha2-512,hmac-sha1
KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org
,ecdh-sha2-nistp256
Save the file and exit.
Restart the SSH service:
sudo systemctl restart sshd
Verify SSH is running:
sudo systemctl status sshd