WARNING: connection is not using a post-quantum key exchange algorithm.

English Backup and data protection
,
1

Following the upgrade to the QuTS hero h6.0.0.3500, I encountered an issue with the HBS 3 backup of the servers installed on Rocky Linux via rsync. The error message is logged in the log and sent via email after the backup job fails.

Device Name: NAS03
Severity: Error
Date/Time: 2026/06/08 15:43:33

App Name: Hybrid Backup Sync
Category: Job Status
Message: [Hybrid Backup Sync] Failed to complete Sync job: "server9.web.home.int. Encountered error "** WARNING: connection is not using a post-quantum key exchange algorithm. "

It has been observed that the QuTS hero v6 uses OpenSSH v10, while the algorithm utilized on Rocky Linux (OpenSSH v9) falls short of meeting the required standards. To rectify this situation, the following steps should be executed on the Rocky Linux-powered servers:

  1. vim /etc/ssh/sshd_config

and add the following line at the end of the file:

KexAlgorithms mlkem768x25519-sha256,sntrup761x25519-sha512,sntrup761x25519-sha512@openssh.com,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512

  1. systemctl restart sshd && systemctl status sshd - confirm that sshd is running
  2. update-crypto-policies --set DEFAULT:PQ - and restart the host afterwards

It took me some time to identify the issue, so I hope this information proves beneficial to you.

2

To be clear: This is NOT a QNAP issue. It’s an issue with your implementation on your Linux server.

Your title makes it sound like it’s a QNAP problem…

3

I did not assert that the issue was related to the Qnap or HBS. It is evident that the problem is associated with the encryption algorithm employed on the Rocky Linux servers utilizing OpenSSH v9. Since I was unable to find any information regarding this, I simply posted the issue and the corresponding resolution steps.

In contrast, the issue lies not with my implementation but rather with the default encryption settings of the SSH server in the Rocky Linux distribution. I highly doubt that you intentionally included mlkem768x25519-sha256,sntrup761x25519-sha512,sntrup761x25519-sha512@openssh.com algorithms in your SSH configuration file.

4

Hi,

Thank you for reporting this.

We have confirmed that the warning is caused by the OpenSSH update when the remote side does not use a post-quantum key exchange algorithm. Although the rsync transfer may complete successfully, HBS may incorrectly treat this SSH warning output as an error and mark the job as failed.

We have identified the cause and will include a fix in the next release.

Thank you for your understanding.