Yes, your administrator is confusing terminology, and winSCP is not helping you at all.
SFTP never operates “without a key” in the crypto sense. you can totally authenticate with simply username + password, but the SSH layer still has to negotiate encryption keys (kex, ciphers, host key algos) before auth even starts. that error suggests the handshake died before it got to passwords.
the true problem is winSCP 4.2.5. that item predates modern SSH standards by a mile. most GoAnywhere vaults currently only support newer kex algorithms (diffie-hellman-group14, ecdh, etc.), and old winSCP simply doesn’t speak them. result: “couldn’t agree a key exchange algorithm”. nothing to do with domain, same network, or AD. SFTP doesn’t care about that.
fix is straightforward:
upgrade winSCP to a current version
Maintain auth set to password.
Don't even mention a private key.
Allow SSH to automatically negotiate contemporary cryptocurrency
if it still fails after updating, then the GoAnywhere side may be tied down to very specific ciphers/kex, but 99% of the time installing winSCP cures this fast.
tldr: password-only SFTP is good. 16-year-old SSH client is not.
SFTP never operates “without a key” in the crypto sense. you can totally authenticate with simply username + password, but the SSH layer still has to negotiate encryption keys (kex, ciphers, host key algos) before auth even starts. that error suggests the handshake died before it got to passwords.
the true problem is winSCP 4.2.5. that item predates modern SSH standards by a mile. most GoAnywhere vaults currently only support newer kex algorithms (diffie-hellman-group14, ecdh, etc.), and old winSCP simply doesn’t speak them. result: “couldn’t agree a key exchange algorithm”. nothing to do with domain, same network, or AD. SFTP doesn’t care about that.
fix is straightforward:
upgrade winSCP to a current version
Maintain auth set to password.
Don't even mention a private key.
Allow SSH to automatically negotiate contemporary cryptocurrency
if it still fails after updating, then the GoAnywhere side may be tied down to very specific ciphers/kex, but 99% of the time installing winSCP cures this fast.
tldr: password-only SFTP is good. 16-year-old SSH client is not.