那些遇到过的问题

ssh 客户端 OpenSSH_3.1 和 ssh 服务器 OpenSSH_7.3p1 之间的密码兼容性

enz*_*959 7 ssh openssh

我必须更换旧的 ssh 服务器。

旧的 sshd 是 OpenSSH_4.7p1，而新的 sshd 是 OpenSSH_7.3p1。

我也有许多基于 Slackware 8.1 (2002) 的旧客户端和一个非常旧的 ssh 客户端 OpenSSH_3.1p1

FROM : Linux P0101222 2.4.37.9_20130117
       sshd: OpenSSH_3.1p1, SSH protocols 1.5/2.0, OpenSSL 0x0090602f

TO   : Linux LinuxServer1 4.8.10-300.fc25.i686
       sshd: OpenSSH_7.3p1, OpenSSL 1.0.2j-fips  26 Sep 2016

       old sshd: OpenSSH_4.7p1, OpenSSL 0.9.8b 04 May 2006
Run Code Online (Sandbox Code Playgroud)

我现在的问题是，由于使用了不同的密码，旧客户端无法连接到新的 ssh 服务器。

[enzo@P0101222 enzo]$ ssh 192.168.200.37
no matching cipher found: 
client aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,
aes192-cbc,aes256-cbc server chacha20-poly1305@openssh.com,
aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,
aes256-gcm@openssh.com
Run Code Online (Sandbox Code Playgroud)

这里是详细的日志

[enzo@P0101222 enzo]$ ssh -v 192.168.200.37
OpenSSH_3.1p1, SSH protocols 1.5/2.0, OpenSSL 0x0090602f
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Applying options for *
debug1: Rhosts Authentication disabled, 
        originating port will not be trusted.
debug1: restore_uid
debug1: ssh_connect: getuid 500 geteuid 0 anon 1
debug1: Connecting to 192.168.200.37 [192.168.200.37] port 22.
debug1: temporarily_use_uid: 500/500 (e=0)
debug1: restore_uid
debug1: temporarily_use_uid: 500/500 (e=0)
debug1: restore_uid
debug1: Connection established.
debug1: read PEM private key done: type DSA
debug1: read PEM private key done: type RSA
debug1: identity file /home/enzo/.ssh/identity type -1
debug1: identity file /home/enzo/.ssh/id_rsa type 1
debug1: identity file /home/enzo/.ssh/id_dsa type -1
debug1: Remote protocol version 2.0, 
        remote software version OpenSSH_7.3
debug1: match: OpenSSH_7.3 pat OpenSSH*
Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_3.1p1
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
no matching cipher found: client aes128-cbc,
3des-cbc,blowfish-cbc,cast128-cbc,arcfour,aes192-cbc,
aes256-cbc server chacha20-poly1305@openssh.com,aes128-ctr,
aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,
aes256-gcm@openssh.com
debug1: Calling cleanup 0x80634c0(0x0)
Run Code Online (Sandbox Code Playgroud)

我的问题是是否可以管理旧客户端或 sshd 服务器以允许客户端连接到新的 sshd 服务器

_____ 添加 15.12.2016 09:18 ____

下面是一个更详细的日志。是的，对于我的任务，也应该可以在服务器端启用安全性较低的服务器

[enzo@P0101222 enzo]$ ssh -vvv 192.168.200.37
OpenSSH_3.1p1, SSH protocols 1.5/2.0, OpenSSL 0x0090602f
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Applying options for *
debug1: Rhosts Authentication disabled, originating port will not be trusted.
debug1: restore_uid
debug1: ssh_connect: getuid 500 geteuid 0 anon 1
debug1: Connecting to 192.168.200.37 [192.168.200.37] port 22.
debug1: temporarily_use_uid: 500/500 (e=0)
debug1: restore_uid
debug1: temporarily_use_uid: 500/500 (e=0)
debug1: restore_uid
debug1: Connection established.
debug1: read PEM private key done: type DSA
debug1: read PEM private key done: type RSA
debug1: identity file /home/enzo/.ssh/identity type -1
debug3: Not a RSA1 key file /home/enzo/.ssh/id_rsa.
debug2: key_type_from_name: unknown key type '-----BEGIN'
debug3: key_read: no key found
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug2: key_type_from_name: unknown key type '-----END'
debug3: key_read: no key found
debug1: identity file /home/enzo/.ssh/id_rsa type 1
debug1: identity file /home/enzo/.ssh/id_dsa type -1
debug1: Remote protocol version 2.0, remote software version OpenSSH_7.3
debug1: match: OpenSSH_7.3 pat OpenSSH*
Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_3.1p1
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug2: kex_parse_kexinit: diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: ssh-rsa,ssh-dss
debug2: kex_parse_kexinit: aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,aes192-cbc,aes256-cbc
debug2: kex_parse_kexinit: aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,aes192-cbc,aes256-cbc
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: none
debug2: kex_parse_kexinit: none
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit: first_kex_follows 0
debug2: kex_parse_kexinit: reserved 0
debug2: kex_parse_kexinit: curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1
debug2: kex_parse_kexinit: ssh-rsa,rsa-sha2-512,rsa-sha2-256,ecdsa-sha2-nistp256,ssh-ed25519
debug2: kex_parse_kexinit: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com
debug2: kex_parse_kexinit: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com
debug2: kex_parse_kexinit: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: kex_parse_kexinit: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: kex_parse_kexinit: none,zlib@openssh.com
debug2: kex_parse_kexinit: none,zlib@openssh.com
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit: first_kex_follows 0
debug2: kex_parse_kexinit: reserved 0
no matching cipher found: client aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,aes192-cbc,aes256-cbc server chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com
debug1: Calling cleanup 0x80634c0(0x0)
Run Code Online (Sandbox Code Playgroud)

___ 添加 16/12/2016 08:20 ____

感谢 Jakuje 的回答，但我又错过了一些东西。

我在/etc/ssh/ssh_config 文件的末尾添加了建议的命令

[root@LinuxServer1 ssh]# cat /etc/ssh/ssh_config
...
Match Host IP_of_the_legacy_client #can be omited
  Ciphers +aes128-cbc,aes192-cbc,aes256-cbc

KexAlgorithms +diffie-hellman-group-exchange-sha1


#
# To modify the system-wide ssh configuration, create a  *.conf  file under
#  /etc/ssh/ssh_config.d/  which will be automatically included below
Include /etc/ssh/ssh_config.d/*.conf
Run Code Online (Sandbox Code Playgroud)

`

但客户端连接失败

[enzo@P0101222 test]$ ssh -vvv 192.168.200.37
OpenSSH_3.1p1, SSH protocols 1.5/2.0, OpenSSL 0x0090602f
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Applying options for *
debug1: Rhosts Authentication disabled, originating port will not be trusted.
debug1: restore_uid
debug1: ssh_connect: getuid 500 geteuid 0 anon 1
debug1: Connecting to 192.168.200.37 [192.168.200.37] port 22.
debug1: temporarily_use_uid: 500/500 (e=0)
debug1: restore_uid
debug1: temporarily_use_uid: 500/500 (e=0)
debug1: restore_uid
debug1: Connection established.
debug1: read PEM private key done: type DSA
debug1: read PEM private key done: type RSA
debug1: identity file /home/enzo/.ssh/identity type -1
debug3: Not a RSA1 key file /home/enzo/.ssh/id_rsa.
debug2: key_type_from_name: unknown key type '-----BEGIN'
debug3: key_read: no key found
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug2: key_type_from_name: unknown key type '-----END'
debug3: key_read: no key found
debug1: identity file /home/enzo/.ssh/id_rsa type 1
debug1: identity file /home/enzo/.ssh/id_dsa type -1
debug1: Remote protocol version 2.0, remote software version OpenSSH_7.3
debug1: match: OpenSSH_7.3 pat OpenSSH*
Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_3.1p1
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug2: kex_parse_kexinit: diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: ssh-rsa,ssh-dss
debug2: kex_parse_kexinit: aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,aes192-cbc,aes256-cbc
debug2: kex_parse_kexinit: aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,aes192-cbc,aes256-cbc
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: none
debug2: kex_parse_kexinit: none
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit: first_kex_follows 0
debug2: kex_parse_kexinit: reserved 0
debug2: kex_parse_kexinit: curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1
debug2: kex_parse_kexinit: ssh-rsa,rsa-sha2-512,rsa-sha2-256,ecdsa-sha2-nistp256,ssh-ed25519
debug2: kex_parse_kexinit: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com
debug2: kex_parse_kexinit: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com
debug2: kex_parse_kexinit: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: kex_parse_kexinit: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: kex_parse_kexinit: none,zlib@openssh.com
debug2: kex_parse_kexinit: none,zlib@openssh.com
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit: first_kex_follows 0
debug2: kex_parse_kexinit: reserved 0
no matching cipher found: client aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,aes192-cbc,aes256-cbc server chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com
debug1: Calling cleanup 0x80634c0(0x0)
Run Code Online (Sandbox Code Playgroud)

在服务器上我有这个通知 

Dec 16 08:19:18 LinuxServer1 audit: CRYPTO_KEY_USER pid=27156 uid=0 auid=0 ses=9 msg='op=destroy kind=server fp=SHA256:b8:d0:f8:52:c7:21:3e:ff:fb:71:2f:f1:c5:f4:ac:76:1f:1c:5e:0d:e5:10:30:9a:c7:4a:de:1b:11:13:11:7b direction=? spid=27156 suid=0  exe="/usr/sbin/sshd" hostname=? addr=? terminal=? res=success'
Dec 16 08:19:18 LinuxServer1 audit: CRYPTO_KEY_USER pid=27156 uid=0 auid=0 ses=9 msg='op=destroy kind=server fp=SHA256:2b:3f:d0:85:0a:dd:78:0c:5a:4b:c4:eb:77:08:6e:ae:7a:8c:24:dc:52:cb:13:5d:d0:9d:c6:52:af:e9:a8:59 direction=? spid=27156 suid=0  exe="/usr/sbin/sshd" hostname=? addr=? terminal=? res=success'
Dec 16 08:19:18 LinuxServer1 audit: CRYPTO_KEY_USER pid=27156 uid=0 auid=0 ses=9 msg='op=destroy kind=server fp=SHA256:dc:75:c4:fd:90:f9:94:5a:b6:9e:d2:cc:04:68:f1:3a:cf:d0:f5:ad:a1:89:c5:a4:91:ef:50:42:ec:9e:a2:1d direction=? spid=27156 suid=0  exe="/usr/sbin/sshd" hostname=? addr=? terminal=? res=success'

==> secure <==
Dec 16 08:19:18 LinuxServer1 sshd[27155]: Unable to negotiate with 192.168.200.222 port 55702: no matching key exchange method found. Their offer: diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 [preauth]

==> messages <==
Dec 16 08:19:18 LinuxServer1 audit: CRYPTO_KEY_USER pid=27155 uid=0 auid=0 ses=9 msg='op=destroy kind=server fp=SHA256:dc:75:c4:fd:90:f9:94:5a:b6:9e:d2:cc:04:68:f1:3a:cf:d0:f5:ad:a1:89:c5:a4:91:ef:50:42:ec:9e:a2:1d direction=? spid=27156 suid=74  exe="/usr/sbin/sshd" hostname=? addr=? terminal=? res=success'
Dec 16 08:19:18 LinuxServer1 audit: CRYPTO_KEY_USER pid=27155 uid=0 auid=0 ses=9 msg='op=destroy kind=server fp=SHA256:b8:d0:f8:52:c7:21:3e:ff:fb:71:2f:f1:c5:f4:ac:76:1f:1c:5e:0d:e5:10:30:9a:c7:4a:de:1b:11:13:11:7b direction=? spid=27155 suid=0  exe="/usr/sbin/sshd" hostname=? addr=? terminal=? res=success'
Dec 16 08:19:18 LinuxServer1 audit: CRYPTO_KEY_USER pid=27155 uid=0 auid=0 ses=9 msg='op=destroy kind=server fp=SHA256:2b:3f:d0:85:0a:dd:78:0c:5a:4b:c4:eb:77:08:6e:ae:7a:8c:24:dc:52:cb:13:5d:d0:9d:c6:52:af:e9:a8:59 direction=? spid=27155 suid=0  exe="/usr/sbin/sshd" hostname=? addr=? terminal=? res=success'
Dec 16 08:19:18 LinuxServer1 audit: CRYPTO_KEY_USER pid=27155 uid=0 auid=0 ses=9 msg='op=destroy kind=server fp=SHA256:dc:75:c4:fd:90:f9:94:5a:b6:9e:d2:cc:04:68:f1:3a:cf:d0:f5:ad:a1:89:c5:a4:91:ef:50:42:ec:9e:a2:1d direction=? spid=27155 suid=0  exe="/usr/sbin/sshd" hostname=? addr=? terminal=? res=success'
Dec 16 08:19:18 LinuxServer1 audit: USER_LOGIN pid=27155 uid=0 auid=0 ses=9 msg='op=login acct="(unknown)" exe="/usr/sbin/sshd" hostname=? addr=192.168.200.222 terminal=ssh res=failed'
Run Code Online (Sandbox Code Playgroud)

Jak*_*uje 8

从输出中，客户端提供了这个密码列表：

debug2: kex_parse_kexinit: aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,aes192-cbc,aes256-cbc

和服务器这个：

debug2: kex_parse_kexinit: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com

你可以注意到，没有交集。

当前的openssh*-cbc默认不提供密码模式，但您可以将其配置为接受它们使用（真正的攻击非常复杂）

Match Host IP_of_the_legacy_client #can be omited
  Ciphers +aes128-cbc,aes192-cbc,aes256-cbc
Run Code Online (Sandbox Code Playgroud)

在你的sshd_config.

使用密钥交换方法也会遇到类似的问题。客户只提供

debug2: kex_parse_kexinit: diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1

但服务器有不同的设置：

debug2: kex_parse_kexinit: curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha256,diffie-hellman-group地狱曼-group18-sha512，diffie-hellman-group14-sha256，diffie-hellman-group14-sha1

但是同样，这些方法仍然存在于当前的 OpenSSH 中，并且可以在sshd_config：

KexAlgorithms +diffie-hellman-group-exchange-sha1
Run Code Online (Sandbox Code Playgroud)

最后一件事是MAC，你可以找到common，hmac-sha1所以没有问题。

有关更多信息，请参阅OpenSSH的Legacy 页面。

归档时间：

查看次数：

13703 次

最近记录：

9 年，4 月 前
相关归档
如何否认正在运行的进程并将其关联到新的屏幕外壳？ 181
如何通过 ssh 远程编辑文件？ 123
如何将 PEM 密钥转换为 RSA 密钥对？ 8
为什么我不能在远程主机上执行 SSH 命令？ 7
SSH 端口将本地 IRC 服务器转发到我的远程服务器 5
如何将公钥复制到您的服务器 4
总是将非 FQDN 域查找为 .example.com？ 3
没有密码提示的 SCP 使用不同的用户名 3
ssh 客户端会干扰命名管道吗？ 3
监视/监视 tty1 还是通过 SSH 查看 tty1 的输出？ 2
难疑归档
如何在文件末尾添加换行符？ 237
.bashrc 的目的是什么，它是如何工作的？ 228
如何将所有文件（包括隐藏文件）从一个目录移动到另一个目录？ 192
当您尝试连接到错误的服务器时，您的 SSH 密码是否被泄露？ 191
在 Bash 中引用 $（命令替换） 173
在 tmux 中重新编号窗口 169
shellshock (CVE-2014-6271/7169) 错误是什么时候引入的，完全修复它的补丁是什么？ 122
-m conntrack --ctstate 和 -m state --state 有什么区别 105
如何在没有 sudo 权限的情况下在本地安装程序？ 98
在linux中杀死tcp连接 86