# \[SOLVED\] File Manager "Unknown error" after Ubuntu 26.04 upgrade — "No compatible key exchange algorithms found" (bundled phpseclib vs. new OpenSSH) **URL:** \ **Category:** System\ **Created:** [October 24, 2026, 4:29pm UTC](https://forum.hestiacp.com/t/solved-file-manager-unknown-error-after-ubuntu-26-04-upgrade-no-compatible-key-exchange-algorithms-found-bundled-phpseclib-vs-new-openssh/22353 "2026-10-24T16:29:38Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![chrmina](https://forum.hestiacp.com/user_avatar/forum.hestiacp.com/chrmina/32/8803_2.png) [@chrmina](https://forum.hestiacp.com/u/chrmina)\ **Post date:** [October 24, 2026, 4:29pm UTC](https://forum.hestiacp.com/t/solved-file-manager-unknown-error-after-ubuntu-26-04-upgrade-no-compatible-key-exchange-algorithms-found-bundled-phpseclib-vs-new-openssh/22353/1 "2026-10-24T16:29:38Z")
![Screenshot 2026-10-25 000700](https://forum.hestiacp.com/uploads/default/original/2X/4/481d72234dcbb04a80b0d3aa0b529ad1be99549c.png) **Note that the report was generated with the help of AI. It took me several hours to find a fix after researching the web and finally using AI.** ## TL;DR After upgrading Ubuntu 24.04 → 26.04, the HestiaCP File Manager shows a red **“Unknown error”** and an empty file listing, for **all users** (admin and regular). Root cause: the File Manager connects to the local SSH daemon over SFTP using Hestia’s **bundled phpseclib** , which only speaks classic `diffie-hellman-*` key exchange — while Ubuntu 26.04’s OpenSSH has dropped all `diffie-hellman-*` algorithms from its default `KexAlgorithms`. The handshake fails before login, so no files can be listed. Workaround below (sshd drop-in); proper fix is an updated phpseclib in Hestia’s `web/fm/vendor/`. ## Environment - HestiaCP **1.10.5-1+ubuntu26.04** (current release at time of writing — no newer version fixes this) - Ubuntu **26.04** (aarch64 / Oracle Cloud), upgraded from 24.04 - Symptom reproduces for every panel user ## Symptoms - File Manager opens but shows **“Unknown error”** and no files, both as admin and as a normal user. - `/var/log/hestia/nginx-error.log` shows, on every directory listing (`POST /fm/?r=/getdir`): ```auto PHP Notice: No compatible key exchange algorithms found in /usr/local/hestia/web/fm/vendor/phpseclib/phpseclib/phpseclib/Net/SSH2.php on line 1758 PHP message: League\Flysystem\Sftp\ConnectionErrorException: Could not login with username: , host: 127.0.0.1 in /usr/local/hestia/web/fm/vendor/league/flysystem-sftp/src/SftpAdapter.php:244 Stack trace: #0 .../SftpAdapter.php(207): League\Flysystem\Sftp\SftpAdapter->login() #1 .../AbstractFtpAdapter.php(650): ...->connect() ... #4 .../Filesystem.php(272): ...->listContents() ``` - Regular SSH access to the server works perfectly — which is what makes this confusing. ## Root cause The File Manager does **not** read the filesystem directly. It logs into the **local sshd over SFTP** (`host: 127.0.0.1`) as the panel user, using the PHP SSH library phpseclib bundled under `/usr/local/hestia/web/fm/vendor/`. Ubuntu 26.04’s OpenSSH offers only modern key-exchange algorithms: ```auto $ sudo sshd -T | grep -i kexalgorithms kexalgorithms mlkem768x25519-sha256,sntrup761x25519-sha512,sntrup761x25519-sha512@openssh.com, curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521 ``` Note there is **not a single `diffie-hellman-*` entry** — they are gone from the defaults. (The system OpenSSH _client_ still negotiates fine because it supports the modern algorithms — e.g. `kex: algorithm: mlkem768x25519-sha256` — which is why nothing else looks broken.) Hestia’s bundled phpseclib is an older generation that only implements classic DH key exchange. Client list ∩ server list = empty → `No compatible key exchange algorithms found` → the SFTP login fails at the handshake → the panel surfaces it as “Unknown error”. Nothing is wrong with users, keys, or permissions. (Same genre as phpseclib’s known “No compatible server to client message authentication algorithms found” / “No compatible key exchange algorithms found” reports against modern servers: old client library vs. new server algorithm set.) ## Workaround: re-enable the legacy algorithms in sshd **Important:** `KexAlgorithms`, `Macs` and `HostKeyAlgorithms` are **global-only** sshd directives — putting them in a `Match` block fails with: ```auto Directive 'KexAlgorithms' is not allowed within a Match block ``` (so you cannot scope them to `Match Address 127.0.0.1` — I tried, and `sshd -t` rejects it. They must go in globally.) Create a drop-in: ```bash sudo nano /etc/ssh/sshd_config.d/90-hestia-fm-kex.conf ``` ```sshconfig # Legacy algorithms required by HestiaCP File Manager (old bundled phpseclib) # against Ubuntu 26.04's OpenSSH, which dropped diffie-hellman from defaults. # Remove this file once Hestia ships an updated phpseclib in the FM vendor tree. KexAlgorithms +diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1 Macs +hmac-sha1,hmac-sha2-256 HostKeyAlgorithms +ssh-rsa PubkeyAcceptedAlgorithms +ssh-rsa ``` Then: ```bash sudo sshd -t # MUST print nothing before you restart! sudo systemctl restart ssh ``` Notes on the contents: - `+` is **additive** — the modern algorithms remain first in the list; modern clients (your own SSH) still negotiate exactly what they did before (verified: still `mlkem768x25519-sha256`). - Kept minimal on purpose: `diffie-hellman-group-exchange-sha256` + `group14-sha1` cover old phpseclib without re-enabling the truly broken `diffie-hellman-group1-sha1` / `ssh-dss`. If the FM still fails after this, add those two to the same lines. - The `Macs` and `HostKeyAlgorithms`/`PubkeyAcceptedAlgorithms` lines preempt the _next_ errors you’d hit after KEX succeeds — old phpseclib typically trips on `hmac-sha1`/SHA-1 RSA signatures next (“No compatible … MAC algorithms” is the sibling error). ## Verification 1. Open the File Manager — directories and file editing work again (checked with both `admin` and a normal user). 2. Log forensics: every `getdir` failure in `nginx-error.log` is timestamped **before** the restart; afterwards the log stays silent while browsing/editing. Quick check: ```bash sudo awk '/^20[0-9][0-9]\//{ts=$0} /getdir/{print NR" -> "ts}' /var/log/hestia/nginx-error.log ``` 1. `sudo sshd -T | grep kexalgorithms` — modern list intact for remote clients. ## Security caveat Since sshd can’t scope these by source address, the legacy algorithms are offered to **all** SSH clients while the file exists. Modern clients never select them (the modern algorithms are listed first), so practical exposure is limited to legacy-only clients — but do delete the drop-in once Hestia ships an updated phpseclib in `web/fm/vendor/`. A quick re-test after each Hestia update: move the file away, restart `ssh`, open the FM — if it works, retire the file. ## Request to maintainers This will hit **every Hestia install on Ubuntu 26.04** , since the distro dropped `diffie-hellman-*` from sshd defaults. The durable fix is updating the bundled phpseclib in `/usr/local/hestia/web/fm/vendor/` to a current generation (phpseclib 3.x handles modern KEX). Repro material: version `1.10.5-1+ubuntu26.04`, the `Net/SSH2.php:1758` + `SftpAdapter.php:244` pair quoted above, and the `sshd -T` output. ---
**Author:** ![sahsanu](https://forum.hestiacp.com/user_avatar/forum.hestiacp.com/sahsanu/32/9318_2.png) [@sahsanu](https://forum.hestiacp.com/u/sahsanu)\ **Post date:** [October 24, 2026, 5:05pm UTC](https://forum.hestiacp.com/t/solved-file-manager-unknown-error-after-ubuntu-26-04-upgrade-no-compatible-key-exchange-algorithms-found-bundled-phpseclib-vs-new-openssh/22353/2 "2026-10-24T17:05:12Z")
> [@chrmina](#): > > ## Request to maintainers > > This will hit **every Hestia install on Ubuntu 26.04** , since the distro dropped `diffie-hellman-*` from sshd defaults. Next time, you should follow the instructions for [upgrading from Ubuntu 24.04 to 26.04](https://hestiacp.com/docs/server-administration/os-upgrades.html#ubuntu-24-04-noble-to-ubuntu-26-04-resolute), and that problem won’t occur. ---
**Author:** ![sahsanu](https://forum.hestiacp.com/user_avatar/forum.hestiacp.com/sahsanu/32/9318_2.png) [@sahsanu](https://forum.hestiacp.com/u/sahsanu)\ **Post date:** [October 24, 2026, 5:53pm UTC](https://forum.hestiacp.com/t/solved-file-manager-unknown-error-after-ubuntu-26-04-upgrade-no-compatible-key-exchange-algorithms-found-bundled-phpseclib-vs-new-openssh/22353/3 "2026-10-24T17:53:45Z")
I forgot to mention that you must run this script (as indicated in the documentation): **Note** : this script is the one that fixes the issue you had with File Manager and a few more things. ```t /usr/local/hestia/install/upgrade/manual/migrate_conf_to_ubuntu_26.04.sh ``` ---
**Author:** ![chrmina](https://forum.hestiacp.com/user_avatar/forum.hestiacp.com/chrmina/32/8803_2.png) [@chrmina](https://forum.hestiacp.com/u/chrmina)\ **Post date:** [October 25, 2026, 5:37am UTC](https://forum.hestiacp.com/t/solved-file-manager-unknown-error-after-ubuntu-26-04-upgrade-no-compatible-key-exchange-algorithms-found-bundled-phpseclib-vs-new-openssh/22353/4 "2026-10-25T05:37:25Z")
You are right @sahsanu! I rushed to upgrade following the recent PHP vulnerabilities without doing a proper research and preparation. Lesson learned! ---
**Author:** ![chrmina](https://forum.hestiacp.com/user_avatar/forum.hestiacp.com/chrmina/32/8803_2.png) [@chrmina](https://forum.hestiacp.com/u/chrmina)\ **Post date:** [October 25, 2026, 5:38am UTC](https://forum.hestiacp.com/t/solved-file-manager-unknown-error-after-ubuntu-26-04-upgrade-no-compatible-key-exchange-algorithms-found-bundled-phpseclib-vs-new-openssh/22353/5 "2026-10-25T05:38:09Z")
Thank you! I will run the script to fix the rest of the issues. ---
**Author:** ![chrmina](https://forum.hestiacp.com/user_avatar/forum.hestiacp.com/chrmina/32/8803_2.png) [@chrmina](https://forum.hestiacp.com/u/chrmina)\ **Post date:** [October 25, 2026, 6:05am UTC](https://forum.hestiacp.com/t/solved-file-manager-unknown-error-after-ubuntu-26-04-upgrade-no-compatible-key-exchange-algorithms-found-bundled-phpseclib-vs-new-openssh/22353/6 "2026-10-25T06:05:25Z")
This is what AI gave me: **Update:** The Hestia team has published an official migration script for 24.04 → 26.04 (docs → OS upgrades → “Ubuntu 24.04 Noble to Ubuntu 26.04 Resolute”), which includes the SSH KEX fix (`/etc/ssh/sshd_config.d/hestia-kex.conf` with `KexAlgorithms +diffie-hellman-group-exchange-sha256`). It also fixes related fallout (sudoers requiretty, Dovecot 2.4, Bind, Exim, ProFTPd). If you applied my manual drop-in, you can consolidate to the official one — details in my edit above. Thanks to the team for the quick turnaround. ---
**Author:** ![chrmina](https://forum.hestiacp.com/user_avatar/forum.hestiacp.com/chrmina/32/8803_2.png) [@chrmina](https://forum.hestiacp.com/u/chrmina)\ **Post date:** [October 25, 2026, 6:55am UTC](https://forum.hestiacp.com/t/solved-file-manager-unknown-error-after-ubuntu-26-04-upgrade-no-compatible-key-exchange-algorithms-found-bundled-phpseclib-vs-new-openssh/22353/7 "2026-10-25T06:55:56Z")
_Update:_ the script’s Bind section has a guard bug I’ve reported here: [REPORT](https://forum.hestiacp.com/t/bug-migrate-conf-to-ubuntu-26-04-sh-bind-section-breaks-named-when-orphaned-named-conf-default-zones-exists-duplicate-zone/22355)