Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #202686 > unrolled thread

Install openssh-server jessie version deb package on stretch

Started by"owl700@gmail.com" <owl700@gmail.com>
First post2018-11-22 19:40 +0100
Last post2018-11-23 15:50 +0100
Articles 7 — 2 participants

Back to article view | Back to linux.debian.user

Contents

  Install openssh-server jessie version deb package on stretch "owl700@gmail.com" <owl700@gmail.com> - 2018-11-22 19:40 +0100
    Re: Install openssh-server jessie version deb package on stretch Roberto C. Sánchez <roberto@debian.org> - 2018-11-22 19:50 +0100
      Re: Install openssh-server jessie version deb package on stretch "owl700@gmail.com" <owl700@gmail.com> - 2018-11-22 20:50 +0100
        Re: Install openssh-server jessie version deb package on stretch Roberto C. Sánchez <roberto@debian.org> - 2018-11-22 20:50 +0100
          Re: Install openssh-server jessie version deb package on stretch "owl700@gmail.com" <owl700@gmail.com> - 2018-11-22 21:00 +0100
            Re: Install openssh-server jessie version deb package on stretch "owl700@gmail.com" <owl700@gmail.com> - 2018-11-23 12:40 +0100
              Re: Install openssh-server jessie version deb package on stretch Roberto C. Sánchez <roberto@debian.org> - 2018-11-23 15:50 +0100

#202686 — Install openssh-server jessie version deb package on stretch

From"owl700@gmail.com" <owl700@gmail.com>
Date2018-11-22 19:40 +0100
SubjectInstall openssh-server jessie version deb package on stretch
Message-ID<wX23n-72w-15@gated-at.bofh.it>

[Multipart message — attachments visible in raw view] — view raw

Hi, I have compatibility issues with the latest version of openssh-server
and an old dropbear client, the dopbear client stops at preauth

*ov 22 14:34:03 * *myhostname **sshd[3905]: debug1: Client protocol version
2.0; client software version dropbear_0.46*
*Nov 22 14:34:03 **myhostname** sshd[3905]: debug1: no match: dropbear_0.46*
Nov 22 14:34:03 myhostname sshd[3905]: debug1: Local version string
SSH-2.0-OpenSSH_7.4p1 Debian-10+deb9u4
Nov 22 14:34:03 myhostname sshd[3905]: debug1: Enabling compatibility mode
for protocol 2.0
Nov 22 14:34:03 myhostname sshd[3905]: debug2: fd 3 setting O_NONBLOCK
Nov 22 14:34:03 myhostname sshd[3905]: debug2: Network child is on pid 3906
Nov 22 14:34:03 myhostname sshd[3905]: debug3: preauth child monitor started
Nov 22 14:34:03 myhostname sshd[3905]: debug3: privsep user:group 106:65534
[preauth]
Nov 22 14:34:03 myhostname sshd[3905]: debug1: permanently_set_uid:
106/65534 [preauth]
Nov 22 14:34:03 myhostname sshd[3905]: debug1: list_hostkey_types:
ssh-rsa,rsa-sha2-512,rsa-sha2-256,ecdsa-sha2-nistp256 [preauth]
Nov 22 14:34:03 myhostname sshd[3905]: debug3: send packet: type 20
[preauth]
*Nov 22 14:34:03 myhostname sshd[3905]: debug1: SSH2_MSG_KEXINIT sent
[preauth]*

I'm thinking about installing the previous version of the package (Jessie)

http://ftp.it.debian.org/debian/pool/main/o/openssh/openssh-server_7.9p1-4_amd64.deb

Do you say that it is possible?

Thanks

[toc] | [next] | [standalone]

#202687

FromRoberto C. Sánchez <roberto@debian.org>
Date2018-11-22 19:50 +0100
Message-ID<wX2d4-765-9@gated-at.bofh.it>
In reply to#202686
On Thu, Nov 22, 2018 at 07:32:07PM +0100, owl700@gmail.com wrote:
>    Hi, I have compatibility issues with the latest version of openssh-server
>    and an old dropbear client, the dopbear client stops at preauth
>    ov 22 14:34:03  myhostname sshd[3905]: debug1: Client protocol version
>    2.0; client software version dropbear_0.46
>    Nov 22 14:34:03 myhostname sshd[3905]: debug1: no match: dropbear_0.46
>    Nov 22 14:34:03 myhostname sshd[3905]: debug1: Local version string
>    SSH-2.0-OpenSSH_7.4p1 Debian-10+deb9u4
>    Nov 22 14:34:03 myhostname sshd[3905]: debug1: Enabling compatibility mode
>    for protocol 2.0
>    Nov 22 14:34:03 myhostname sshd[3905]: debug2: fd 3 setting O_NONBLOCK
>    Nov 22 14:34:03 myhostname sshd[3905]: debug2: Network child is on pid
>    3906
>    Nov 22 14:34:03 myhostname sshd[3905]: debug3: preauth child monitor
>    started
>    Nov 22 14:34:03 myhostname sshd[3905]: debug3: privsep user:group
>    106:65534 [preauth]
>    Nov 22 14:34:03 myhostname sshd[3905]: debug1: permanently_set_uid:
>    106/65534 [preauth]
>    Nov 22 14:34:03 myhostname sshd[3905]: debug1: list_hostkey_types:
>    ssh-rsa,rsa-sha2-512,rsa-sha2-256,ecdsa-sha2-nistp256 [preauth]
>    Nov 22 14:34:03 myhostname sshd[3905]: debug3: send packet: type 20
>    [preauth]
>    Nov 22 14:34:03 myhostname sshd[3905]: debug1: SSH2_MSG_KEXINIT sent
>    [preauth]
>    I'm thinking about installing the previous version of the package (Jessie)
>    [1]http://ftp.it.debian.org/debian/pool/main/o/openssh/openssh-server_7.9p1-4_amd64.deb
>    Do you say that it is possible?
>    Thanks
> 

That is actually a terrible idea.

You are better off editing /etc/sshd_config and enabling appropriate key
exchange and cipher algorithms that are compatible with the old dropbear
client.

Given the potential security issues there, a beter approach is to
instead create a copy of the current configuration, make the necessary
changes to be compatible with dropbear, then run two sshd instances.
Make the one with the weak algorithms only accessible to the IP from
which the dropbear connection will initiate (you can do this in your
system firewall) and then make it only accessible to the specific user
(you can do this with an AllowUsers directive in that instances
sshd_config).  The other instance can remain accessible as you currently
have it with no degradation of security.

You will also need to decide which instance will run on which ports,
since both cannot occupy the same port.  Alternately, if the machine has
multiple IP addresses, the two instances can be on the same port bound
to different addresses.

Regards,

-Roberto

-- 
Roberto C. Sánchez

[toc] | [prev] | [next] | [standalone]

#202692

From"owl700@gmail.com" <owl700@gmail.com>
Date2018-11-22 20:50 +0100
Message-ID<wX397-7Gd-3@gated-at.bofh.it>
In reply to#202687
Thanks Roberto,

I have tried also the latest dropbear server but this is incompatible too

Do you have idea how can I find appropriate key exchange and cipher algorithms?

Il giorno gio 22 nov 2018 alle ore 19:42 Roberto C. Sánchez
<roberto@debian.org> ha scritto:
>
> On Thu, Nov 22, 2018 at 07:32:07PM +0100, owl700@gmail.com wrote:
> >    Hi, I have compatibility issues with the latest version of openssh-server
> >    and an old dropbear client, the dopbear client stops at preauth
> >    ov 22 14:34:03  myhostname sshd[3905]: debug1: Client protocol version
> >    2.0; client software version dropbear_0.46
> >    Nov 22 14:34:03 myhostname sshd[3905]: debug1: no match: dropbear_0.46
> >    Nov 22 14:34:03 myhostname sshd[3905]: debug1: Local version string
> >    SSH-2.0-OpenSSH_7.4p1 Debian-10+deb9u4
> >    Nov 22 14:34:03 myhostname sshd[3905]: debug1: Enabling compatibility mode
> >    for protocol 2.0
> >    Nov 22 14:34:03 myhostname sshd[3905]: debug2: fd 3 setting O_NONBLOCK
> >    Nov 22 14:34:03 myhostname sshd[3905]: debug2: Network child is on pid
> >    3906
> >    Nov 22 14:34:03 myhostname sshd[3905]: debug3: preauth child monitor
> >    started
> >    Nov 22 14:34:03 myhostname sshd[3905]: debug3: privsep user:group
> >    106:65534 [preauth]
> >    Nov 22 14:34:03 myhostname sshd[3905]: debug1: permanently_set_uid:
> >    106/65534 [preauth]
> >    Nov 22 14:34:03 myhostname sshd[3905]: debug1: list_hostkey_types:
> >    ssh-rsa,rsa-sha2-512,rsa-sha2-256,ecdsa-sha2-nistp256 [preauth]
> >    Nov 22 14:34:03 myhostname sshd[3905]: debug3: send packet: type 20
> >    [preauth]
> >    Nov 22 14:34:03 myhostname sshd[3905]: debug1: SSH2_MSG_KEXINIT sent
> >    [preauth]
> >    I'm thinking about installing the previous version of the package (Jessie)
> >    [1]http://ftp.it.debian.org/debian/pool/main/o/openssh/openssh-server_7.9p1-4_amd64.deb
> >    Do you say that it is possible?
> >    Thanks
> >
>
> That is actually a terrible idea.
>
> You are better off editing /etc/sshd_config and enabling appropriate key
> exchange and cipher algorithms that are compatible with the old dropbear
> client.
>
> Given the potential security issues there, a beter approach is to
> instead create a copy of the current configuration, make the necessary
> changes to be compatible with dropbear, then run two sshd instances.
> Make the one with the weak algorithms only accessible to the IP from
> which the dropbear connection will initiate (you can do this in your
> system firewall) and then make it only accessible to the specific user
> (you can do this with an AllowUsers directive in that instances
> sshd_config).  The other instance can remain accessible as you currently
> have it with no degradation of security.
>
> You will also need to decide which instance will run on which ports,
> since both cannot occupy the same port.  Alternately, if the machine has
> multiple IP addresses, the two instances can be on the same port bound
> to different addresses.
>
> Regards,
>
> -Roberto
>
> --
> Roberto C. Sánchez
>

[toc] | [prev] | [next] | [standalone]

#202694

FromRoberto C. Sánchez <roberto@debian.org>
Date2018-11-22 20:50 +0100
Message-ID<wX397-7Gd-5@gated-at.bofh.it>
In reply to#202692
On Thu, Nov 22, 2018 at 08:40:52PM +0100, owl700@gmail.com wrote:
> Thanks Roberto,
> 
> I have tried also the latest dropbear server but this is incompatible too
> 
> Do you have idea how can I find appropriate key exchange and cipher algorithms?
> 
Please don't top post.  It is considered impolite.

I do not use dropbear, but I would expect its documentation should
provide a list of supported key exchange and cipher algorithms.  You
could then look at the output of 'ssh -Q kex' and 'ssh -Q cipher' for
lists of key exchange and cipher algorithms supported by ssh on your
system, respectively.

I also forgot to mention in my earlier reply that you might need to
specify weaker MAC algorithms.  Available MAC algorithms can be obtained
with 'ssh -Q mac'.

Regards,

-Roberto

-- 
Roberto C. Sánchez

[toc] | [prev] | [next] | [standalone]

#202695

From"owl700@gmail.com" <owl700@gmail.com>
Date2018-11-22 21:00 +0100
Message-ID<wX3iN-7JJ-1@gated-at.bofh.it>
In reply to#202694
Il giorno gio 22 nov 2018 alle ore 20:48 Roberto C. Sánchez
<roberto@debian.org> ha scritto:
>
> On Thu, Nov 22, 2018 at 08:40:52PM +0100, owl700@gmail.com wrote:
> > Thanks Roberto,
> >
> > I have tried also the latest dropbear server but this is incompatible too
> >
> > Do you have idea how can I find appropriate key exchange and cipher algorithms?
> >
> Please don't top post.  It is considered impolite.
>
> I do not use dropbear, but I would expect its documentation should
> provide a list of supported key exchange and cipher algorithms.  You
> could then look at the output of 'ssh -Q kex' and 'ssh -Q cipher' for
> lists of key exchange and cipher algorithms supported by ssh on your
> system, respectively.
>
> I also forgot to mention in my earlier reply that you might need to
> specify weaker MAC algorithms.  Available MAC algorithms can be obtained
> with 'ssh -Q mac'.
>
> Regards,
>
> -Roberto
>
> --
> Roberto C. Sánchez
>

Thanks Roberto, tomorrow ill'try

[toc] | [prev] | [next] | [standalone]

#202708

From"owl700@gmail.com" <owl700@gmail.com>
Date2018-11-23 12:40 +0100
Message-ID<wXhYu-aQ-9@gated-at.bofh.it>
In reply to#202695
Il giorno gio 22 nov 2018 alle ore 20:50 owl700@gmail.com
<owl700@gmail.com> ha scritto:
>
> Il giorno gio 22 nov 2018 alle ore 20:48 Roberto C. Sánchez
> <roberto@debian.org> ha scritto:
> >
> > On Thu, Nov 22, 2018 at 08:40:52PM +0100, owl700@gmail.com wrote:
> > > Thanks Roberto,
> > >
> > > I have tried also the latest dropbear server but this is incompatible too
> > >
> > > Do you have idea how can I find appropriate key exchange and cipher algorithms?
> > >
> > Please don't top post.  It is considered impolite.
> >
> > I do not use dropbear, but I would expect its documentation should
> > provide a list of supported key exchange and cipher algorithms.  You
> > could then look at the output of 'ssh -Q kex' and 'ssh -Q cipher' for
> > lists of key exchange and cipher algorithms supported by ssh on your
> > system, respectively.
> >
> > I also forgot to mention in my earlier reply that you might need to
> > specify weaker MAC algorithms.  Available MAC algorithms can be obtained
> > with 'ssh -Q mac'.
> >
> > Regards,
> >
> > -Roberto
> >
> > --
> > Roberto C. Sánchez
> >
>
> Thanks Roberto, tomorrow ill'try

I have tried to use the right KexAlgorithm and Ciphers, but dropbear
client fail always

myhostname sshd[3905]: debug1: SSH2_MSG_KEXINIT sent [preauth]

There aren't other debug messages

Only for test purpose i have add all options i can in
/etc/sshd_config, but nothing, what am I doing wrong?

Ciphers 3des-cbc,blowfish-cbc,cast128-cbc,arcfour,arcfour128,arcfour256,aes128-cbc,aes192-cbc,aes256-cbc,rijndael-cbc@lysator.liu.se,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com
HostbasedAcceptedKeyTypes
ssh-ed25519,ssh-ed25519-cert-v01@openssh.com,ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com
HostKeyAlgorithms
ssh-ed25519,ssh-ed25519-cert-v01@openssh.com,ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com
KexAlgorithms diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org
MACs hmac-sha1,hmac-sha1-96,hmac-sha2-256,hmac-sha2-512,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-md5-96-etm@openssh.com,hmac-ripemd160-etm@openssh.com,umac-64-etm@openssh.com,umac-128-etm@openssh.com
PubkeyAcceptedKeyTypes
ssh-ed25519,ssh-ed25519-cert-v01@openssh.com,ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com

[toc] | [prev] | [next] | [standalone]

#202734

FromRoberto C. Sánchez <roberto@debian.org>
Date2018-11-23 15:50 +0100
Message-ID<wXkWl-22F-15@gated-at.bofh.it>
In reply to#202708
On Fri, Nov 23, 2018 at 12:29:41PM +0100, owl700@gmail.com wrote:
> 
> I have tried to use the right KexAlgorithm and Ciphers, but dropbear
> client fail always
> 
Do you have "LogLevel DEBUG3" in sshd_config?  Can you specify a high
debug log level on the dropbear side?

Regards,

-Roberto

-- 
Roberto C. Sánchez

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.user

csiph-web