Release SuperZaxxon v1.76 SSH Login issues


Magic Sam

Forever Homebrew
Joined
Aug 10, 2007
Messages
2,306
Age
38
Location
Innsmouth, MA
Hi all,

I can't easily log into my Pandora using ssh anymore:

samuel@portable:~$ ssh samuel@192.168.1.67
Unable to negotiate with 192.168.1.67 port 22: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1,diffie-hellman-group14-sha1

But this did the trick:

samuel@portable:~$ ssh -o KexAlgorithms=+diffie-hellman-group1-sha1 samuel@192.168.1.67
pandora:~$

I'm trying to connect from a Debian 10 x86_64 host:

OpenSSH_8.4p1 Debian-2~bpo10+1, OpenSSL 1.1.1d 10 Sep 2019

Is this still compatible with the older version we're running on the Pandora ?

OpenSSH_5.2p1, OpenSSL 0.9.8zh 3 Dec 2015

Am I the only one with that issue ? Should someone update OpenSSH / Dropbear / OpenSSL on the Pandora ?

Cheers, Magic Sam
 

PowerGod

Hardcore Member
Joined
Jun 20, 2011
Messages
3,781
The algorithm specification was required starting from some years ago.

I just tried with an updated Debian 9, and it worked without issues and no configuration at all, but OpenSSH is less recent.

What errors you can see ?

Have you already tried to add the algorithms to "/etc/ssh/ssh_config" or "~/.ssh/config" ?

EDIT:
I also tried with Cygwin that has SSH and SSL more recent than yours, and it connects without issues too.

This is what I have in the "~/.ssh/config" of Cygwin
Code:
Host 192.168.0.3
Port 22
KexAlgorithms +diffie-hellman-group1-sha1
Ciphers +3des-cbc
StrictHostKeyChecking no
UserKnownHostsFile=/dev/null
 
Last edited:
  • Like
Reactions: rSl

Magic Sam

Forever Homebrew
Joined
Aug 10, 2007
Messages
2,306
Age
38
Location
Innsmouth, MA
Hi all,

@PowerGod : this is the complete output in verbose mode:

samuel@portable:~$ ssh -vvv 192.168.1.67
OpenSSH_8.4p1 Debian-2~bpo10+1, OpenSSL 1.1.1d 10 Sep 2019
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: include /etc/ssh/ssh_config.d/*.conf matched no files
debug1: /etc/ssh/ssh_config line 21: Applying options for *
debug2: resolve_canonicalize: hostname 192.168.1.67 is address
debug3: expanded UserKnownHostsFile '~/.ssh/known_hosts' -> '/home/samuel/.ssh/known_hosts'
debug3: expanded UserKnownHostsFile '~/.ssh/known_hosts2' -> '/home/samuel/.ssh/known_hosts2'
debug2: ssh_connect_direct
debug1: Connecting to 192.168.1.67 [192.168.1.67] port 22.
debug1: Connection established.
debug1: identity file /home/samuel/.ssh/id_rsa type 0
debug1: identity file /home/samuel/.ssh/id_rsa-cert type -1
debug1: identity file /home/samuel/.ssh/id_dsa type -1
debug1: identity file /home/samuel/.ssh/id_dsa-cert type -1
debug1: identity file /home/samuel/.ssh/id_ecdsa type -1
debug1: identity file /home/samuel/.ssh/id_ecdsa-cert type -1
debug1: identity file /home/samuel/.ssh/id_ecdsa_sk type -1
debug1: identity file /home/samuel/.ssh/id_ecdsa_sk-cert type -1
debug1: identity file /home/samuel/.ssh/id_ed25519 type -1
debug1: identity file /home/samuel/.ssh/id_ed25519-cert type -1
debug1: identity file /home/samuel/.ssh/id_ed25519_sk type -1
debug1: identity file /home/samuel/.ssh/id_ed25519_sk-cert type -1
debug1: identity file /home/samuel/.ssh/id_xmss type -1
debug1: identity file /home/samuel/.ssh/id_xmss-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_8.4p1 Debian-2~bpo10+1
debug1: Remote protocol version 2.0, remote software version dropbear_0.53.1
debug1: no match: dropbear_0.53.1
debug2: fd 3 setting O_NONBLOCK
debug1: Authenticating to 192.168.1.67:22 as 'samuel'
debug3: hostkeys_foreach: reading file "/home/samuel/.ssh/known_hosts"
debug3: record_hostkey: found key type RSA in file /home/samuel/.ssh/known_hosts:19
debug3: load_hostkeys: loaded 1 keys from 192.168.1.67
debug3: order_hostkeyalgs: prefer hostkeyalgs: rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,rsa-sha2-512,rsa-sha2-256,ssh-rsa
debug3: send packet: type 20
debug1: SSH2_MSG_KEXINIT sent
debug3: receive packet: type 20
debug1: SSH2_MSG_KEXINIT received
debug2: local client KEXINIT proposal
debug2: KEX algorithms: curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,ext-info-c
debug2: host key algorithms: rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,sk-ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,sk-ecdsa-sha2-nistp256@openssh.com,ssh-ed25519,sk-ssh-ed25519@openssh.com
debug2: ciphers ctos: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com
debug2: ciphers stoc: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com
debug2: MACs ctos: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: MACs stoc: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: compression ctos: none,zlib@openssh.com,zlib
debug2: compression stoc: none,zlib@openssh.com,zlib
debug2: languages ctos:
debug2: languages stoc:
debug2: first_kex_follows 0
debug2: reserved 0
debug2: peer server KEXINIT proposal
debug2: KEX algorithms: diffie-hellman-group1-sha1,diffie-hellman-group14-sha1
debug2: host key algorithms: ssh-rsa
debug2: ciphers ctos: aes128-ctr,3des-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes256-cbc,twofish256-cbc,twofish-cbc,twofish128-cbc
debug2: ciphers stoc: aes128-ctr,3des-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes256-cbc,twofish256-cbc,twofish-cbc,twofish128-cbc
debug2: MACs ctos: hmac-sha1-96,hmac-sha1,hmac-md5
debug2: MACs stoc: hmac-sha1-96,hmac-sha1,hmac-md5
debug2: compression ctos: zlib,zlib@openssh.com,none
debug2: compression stoc: zlib,zlib@openssh.com,none
debug2: languages ctos:
debug2: languages stoc:
debug2: first_kex_follows 0
debug2: reserved 0
debug1: kex: algorithm: (no match)
Unable to negotiate with 192.168.1.67 port 22: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1,diffie-hellman-group14-sha1

I haven't tweaked SSH configuration files yet, but I think I will soon :)

Cheers, Magic Sam
 

levi

Still fresh, damnit!
Joined
Oct 6, 2008
Messages
13,510
Location
Somewhere off the coast of the EU
Do you have a ~/.ssh/id_rsa file? I'm not quite sure whether -1 is true or false in that file, but id_rsa is marked as 0. Historically that would indicate to me that you're only got id_rsa and none of the newer ones, but these days it could be that that's been deprecated in favour of newer types. I recall I had to generate one of those on my box so that my Pandora could connect to it a few years ago. The actual logs ends in saying it's offered DH key exchange SHA 1 and it's perhaps not surprising that's not supported any more, but that combination of terms isn't actually known to me, so I'm not entirely sure what to make of it.
 

PowerGod

Hardcore Member
Joined
Jun 20, 2011
Messages
3,781
The issue seems here
Code:
debug2: KEX algorithms: curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,ext-info-c
because no one of these is listed:
Code:
diffie-hellman-group1-sha1,diffie-hellman-group14-sha1
 
Top