Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #236954 > unrolled thread

Suggested way to ssh into obsolete devices (with old ssh crypto)?

Back to article view | Back to linux.debian.user

Contents

  Suggested way to ssh into obsolete devices (with old ssh crypto)? Ralph Aichinger <ra@pi.h5.or.at> - 2021-07-06 11:10 +0200
    Re: Suggested way to ssh into obsolete devices (with old ssh crypto)? "Andrew M.A. Cater" <amacater@einval.com> - 2021-07-06 11:30 +0200
    Re: Suggested way to ssh into obsolete devices (with old ssh crypto)? Roberto C. Sánchez <roberto@debian.org> - 2021-07-06 15:00 +0200
      Re: Suggested way to ssh into obsolete devices (with old ssh crypto)? Stefan Monnier <monnier@iro.umontreal.ca> - 2021-07-06 18:10 +0200
        Re: Suggested way to ssh into obsolete devices (with old ssh crypto)? "Andrew M.A. Cater" <amacater@einval.com> - 2021-07-06 18:40 +0200
          Re: Suggested way to ssh into obsolete devices (with old ssh crypto)? Stefan Monnier <monnier@iro.umontreal.ca> - 2021-07-06 19:10 +0200
            Re: Suggested way to ssh into obsolete devices (with old ssh crypto)? Michael Stone <mstone@debian.org> - 2021-07-06 19:50 +0200
              Re: Suggested way to ssh into obsolete devices (with old ssh crypto)? <tomas@tuxteam.de> - 2021-07-06 20:10 +0200
                Re: Suggested way to ssh into obsolete devices (with old ssh crypto)? Michael Stone <mstone@debian.org> - 2021-07-06 20:20 +0200
                  Re: Suggested way to ssh into obsolete devices (with old ssh crypto)? Roberto C. Sánchez <roberto@debian.org> - 2021-07-06 20:20 +0200
                    Re: Suggested way to ssh into obsolete devices (with old ssh crypto)? Michael Stone <mstone@debian.org> - 2021-07-06 20:40 +0200
                  Re: Suggested way to ssh into obsolete devices (with old ssh crypto)? <tomas@tuxteam.de> - 2021-07-06 22:20 +0200
                    Re: Suggested way to ssh into obsolete devices (with old ssh crypto)? Michael Stone <mstone@debian.org> - 2021-07-06 22:50 +0200
                      Re: Suggested way to ssh into obsolete devices (with old ssh crypto)? <tomas@tuxteam.de> - 2021-07-06 23:50 +0200
                    Re: Suggested way to ssh into obsolete devices (with old ssh crypto)? Stefan Monnier <monnier@iro.umontreal.ca> - 2021-07-06 23:40 +0200
                      Re: Suggested way to ssh into obsolete devices (with old ssh crypto)? <tomas@tuxteam.de> - 2021-07-07 00:00 +0200
                        Re: Suggested way to ssh into obsolete devices (with old ssh crypto)? Stefan Monnier <monnier@iro.umontreal.ca> - 2021-07-07 05:10 +0200
                          Re: Suggested way to ssh into obsolete devices (with old ssh crypto)? <tomas@tuxteam.de> - 2021-07-07 10:00 +0200
                    Re: Suggested way to ssh into obsolete devices (with old ssh crypto)? Karen Lewellen <klewellen@shellworld.net> - 2021-07-07 00:00 +0200
              Re: Suggested way to ssh into obsolete devices (with old ssh crypto)? Stefan Monnier <monnier@iro.umontreal.ca> - 2021-07-06 21:30 +0200
                Re: Suggested way to ssh into obsolete devices (with old ssh crypto)? Michael Stone <mstone@debian.org> - 2021-07-06 21:30 +0200
    Re: Suggested way to ssh into obsolete devices (with old ssh crypto)? Lee <ler762@gmail.com> - 2021-07-07 01:20 +0200

Page 2 of 2 — ← Prev page 1 [2]

#236982

On Tue, Jul 06, 2021 at 03:20:43PM -0400, Stefan Monnier wrote:
>>> If they have buffer overflow-style holes, those should be fixed.
>>> Other than that I can't see how they can be less secure than the "none" cipher.
>> I guess since the "none" cipher isn't supported in debian's ssh
>
>Good point.
>
>> you will just drop this questionable line of argument?
>
>It just moves it to first arguing in favor of supporting `none`.

Luckily for the majority of users, the ssh devs aren't likely to 
suddenly decide to reduce the security of ssh no matter how loudly 
someone asks them to.

Really, if you don't care about security just use telnet.

[toc] | [prev] | [next] | [standalone]

#236995

On 7/6/21, Ralph Aichinger <ra@pi.h5.or.at> wrote:
> Hi, everybody, as a bullseye user I am seeing messages like
>
> | Unable to negotiate with 10.0.17.52 port 22: no matching
> | key exchange method found. Their offer: diffie-hellman-group1-sha1
>
> with increasing frequency, especially when trying to ssh into
> proprietary, obsolete stuff. Above comes from a Cisco 7941 IP
> phone I toy around with at home, with no expectation of security
> whatsoever, I might as well use telnet.
>
> Some algorithms can be activated by using e.g.
>  -oKexAlgorithms=+diffie-hellman-group1-sha1
> but I suppose it is only a question of time before some of this
> really old and insecure stuff is compiled out or removed from
> sources. It is also a bit difficult to find working combinations
> of keyexchange algorithms and ciphers for unknown older servers
> (a lot of trial and error?).

"ssh -v" might tell you enough about what's missing.  And then
ssh -Q kex
  to show available key exchange algorithms, and
ssh -Q cipher
  to show available ciphers

> What is the suggested way to work around that problem?

I like adding that stuff in the ~/.ssh/config file - ref. man ssh_config
for example:
$ head ~/.ssh/config

Host cerberus 10.10.2.1

User dante

KexAlgorithms +diffie-hellman-group1-sha1
# ssh -Q kex
#   show available key exchange algorithms

> What I do not want to do is change my "normal" configuration, e.g.
> add these algorithms to my normal .ssh/config.

Put all the special cases at the top of the config file and all of the
"normal" config stuff at the end, under
Host *

Regards,
Lee

[toc] | [prev] | [standalone]

Page 2 of 2 — ← Prev page 1 [2]

Back to top | Article view | linux.debian.user

csiph-web