Following the upgrade to the QuTS hero h6.0.0.3500, I encountered an issue with the HBS 3 backup of the servers installed on Rocky Linux via rsync. The error message is logged in the log and sent via email after the backup job fails.
App Name: Hybrid Backup Sync
Category: Job Status
Message: [Hybrid Backup Sync] Failed to complete Sync job: "server9.web.home.int. Encountered error "** WARNING: connection is not using a post-quantum key exchange algorithm. "
It has been observed that the QuTS hero v6 uses OpenSSH v10, while the algorithm utilized on Rocky Linux (OpenSSH v9) falls short of meeting the required standards. To rectify this situation, the following steps should be executed on the Rocky Linux-powered servers:
vim /etc/ssh/sshd_config
and add the following line at the end of the file:
I did not assert that the issue was related to the Qnap or HBS. It is evident that the problem is associated with the encryption algorithm employed on the Rocky Linux servers utilizing OpenSSH v9. Since I was unable to find any information regarding this, I simply posted the issue and the corresponding resolution steps.
In contrast, the issue lies not with my implementation but rather with the default encryption settings of the SSH server in the Rocky Linux distribution. I highly doubt that you intentionally included mlkem768x25519-sha256,sntrup761x25519-sha512,sntrup761x25519-sha512@openssh.com algorithms in your SSH configuration file.
We have confirmed that the warning is caused by the OpenSSH update when the remote side does not use a post-quantum key exchange algorithm. Although the rsync transfer may complete successfully, HBS may incorrectly treat this SSH warning output as an error and mark the job as failed.
We have identified the cause and will include a fix in the next release.
The solution is described in the first post. No need to wait for the Qnap. After all, this is not an issue, and there is nothing broken. Read the post.
The way SSH works dictates that the client has the absolute right and duty to decide and declare how it wants to connect. There should be an option to achieve this without relying on the autorun workaround; furthermore, the issue where HBS incorrectly treats this SSH warning output as an error needs to be fixed
The fix may work for Rocky Linux specifically, but it does not work if you have a subscription to an external server which does not provide for a post-quantum key exchange algorithm.
I have this problem on a Synology DSM 918+. QNAP should NEVER have forced the higher encryption setting without giving us the option not to go to it. I am not sure Synology is going to upgrade the way they do rSync. It should be an option to move to the higher encryption AFTER you have verified the other end of your rSync relationships are in compliance.
