이전 SSH 서버를 변경해야 합니다.
이전 sshd는 OpenSSH_4.7p1이고 새 sshd는 OpenSSH_7.3p1입니다.
나는 또한 Slackware 8.1(2002)을 기반으로 한 다수의 오래된 클라이언트와 아주 오래된 SSH 클라이언트인 OpenSSH_3.1p1을 가지고 있습니다.
FROM : Linux P0101222 2.4.37.9_20130117
sshd: OpenSSH_3.1p1, SSH protocols 1.5/2.0, OpenSSL 0x0090602f
TO : Linux LinuxServer1 4.8.10-300.fc25.i686
sshd: OpenSSH_7.3p1, OpenSSL 1.0.2j-fips 26 Sep 2016
old sshd: OpenSSH_4.7p1, OpenSSL 0.9.8b 04 May 2006
내 문제는 이제 다른 비밀번호를 사용하기 때문에 이전 클라이언트가 새 SSH 서버에 연결할 수 없다는 것입니다.
[enzo@P0101222 enzo]$ ssh 192.168.200.37
no matching cipher found:
client aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,
aes192-cbc,aes256-cbc server [email protected],
aes128-ctr,aes192-ctr,aes256-ctr,[email protected],
[email protected]
자세한 로그입니다
[enzo@P0101222 enzo]$ ssh -v 192.168.200.37
OpenSSH_3.1p1, SSH protocols 1.5/2.0, OpenSSL 0x0090602f
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Applying options for *
debug1: Rhosts Authentication disabled,
originating port will not be trusted.
debug1: restore_uid
debug1: ssh_connect: getuid 500 geteuid 0 anon 1
debug1: Connecting to 192.168.200.37 [192.168.200.37] port 22.
debug1: temporarily_use_uid: 500/500 (e=0)
debug1: restore_uid
debug1: temporarily_use_uid: 500/500 (e=0)
debug1: restore_uid
debug1: Connection established.
debug1: read PEM private key done: type DSA
debug1: read PEM private key done: type RSA
debug1: identity file /home/enzo/.ssh/identity type -1
debug1: identity file /home/enzo/.ssh/id_rsa type 1
debug1: identity file /home/enzo/.ssh/id_dsa type -1
debug1: Remote protocol version 2.0,
remote software version OpenSSH_7.3
debug1: match: OpenSSH_7.3 pat OpenSSH*
Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_3.1p1
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
no matching cipher found: client aes128-cbc,
3des-cbc,blowfish-cbc,cast128-cbc,arcfour,aes192-cbc,
aes256-cbc server [email protected],aes128-ctr,
aes192-ctr,aes256-ctr,[email protected],
[email protected]
debug1: Calling cleanup 0x80634c0(0x0)
내 질문은 클라이언트가 새 sshd 서버에 연결할 수 있도록 이전 클라이언트 또는 sshd 서버를 관리하는 것이 가능하다는 것입니다.
_____ 2016년 12월 15일 09:18에 추가됨 ____
아래는 좀 더 자세한 로그입니다. 예, 제 작업을 위해 서버 측에서 덜 안전한 서버를 활성화하는 것도 가능해야 합니다
[enzo@P0101222 enzo]$ ssh -vvv 192.168.200.37
OpenSSH_3.1p1, SSH protocols 1.5/2.0, OpenSSL 0x0090602f
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Applying options for *
debug1: Rhosts Authentication disabled, originating port will not be trusted.
debug1: restore_uid
debug1: ssh_connect: getuid 500 geteuid 0 anon 1
debug1: Connecting to 192.168.200.37 [192.168.200.37] port 22.
debug1: temporarily_use_uid: 500/500 (e=0)
debug1: restore_uid
debug1: temporarily_use_uid: 500/500 (e=0)
debug1: restore_uid
debug1: Connection established.
debug1: read PEM private key done: type DSA
debug1: read PEM private key done: type RSA
debug1: identity file /home/enzo/.ssh/identity type -1
debug3: Not a RSA1 key file /home/enzo/.ssh/id_rsa.
debug2: key_type_from_name: unknown key type '-----BEGIN'
debug3: key_read: no key found
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug2: key_type_from_name: unknown key type '-----END'
debug3: key_read: no key found
debug1: identity file /home/enzo/.ssh/id_rsa type 1
debug1: identity file /home/enzo/.ssh/id_dsa type -1
debug1: Remote protocol version 2.0, remote software version OpenSSH_7.3
debug1: match: OpenSSH_7.3 pat OpenSSH*
Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_3.1p1
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug2: kex_parse_kexinit: diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: ssh-rsa,ssh-dss
debug2: kex_parse_kexinit: aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,aes192-cbc,aes256-cbc
debug2: kex_parse_kexinit: aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,aes192-cbc,aes256-cbc
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,hmac-ripemd160,[email protected],hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,hmac-ripemd160,[email protected],hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: none
debug2: kex_parse_kexinit: none
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit: first_kex_follows 0
debug2: kex_parse_kexinit: reserved 0
debug2: kex_parse_kexinit: [email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1
debug2: kex_parse_kexinit: ssh-rsa,rsa-sha2-512,rsa-sha2-256,ecdsa-sha2-nistp256,ssh-ed25519
debug2: kex_parse_kexinit: [email protected],aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected]
debug2: kex_parse_kexinit: [email protected],aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected]
debug2: kex_parse_kexinit: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: kex_parse_kexinit: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: kex_parse_kexinit: none,[email protected]
debug2: kex_parse_kexinit: none,[email protected]
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit: first_kex_follows 0
debug2: kex_parse_kexinit: reserved 0
no matching cipher found: client aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,aes192-cbc,aes256-cbc server [email protected],aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected]
debug1: Calling cleanup 0x80634c0(0x0)
___ 2016년 16월 12일 08:20에 추가됨 ____
답변해 주신 Jakuje에게 감사드립니다. 하지만 또 한 가지 놓친 부분이 있습니다.
끝에 제안된 명령을 추가했습니다/etc/ssh/ssh_config 파일
[root@LinuxServer1 ssh]# cat /etc/ssh/ssh_config
...
Match Host IP_of_the_legacy_client #can be omited
Ciphers +aes128-cbc,aes192-cbc,aes256-cbc
KexAlgorithms +diffie-hellman-group-exchange-sha1
#
# To modify the system-wide ssh configuration, create a *.conf file under
# /etc/ssh/ssh_config.d/ which will be automatically included below
Include /etc/ssh/ssh_config.d/*.conf
`
하지만 클라이언트가 연결할 수 없습니다.
[enzo@P0101222 test]$ ssh -vvv 192.168.200.37
OpenSSH_3.1p1, SSH protocols 1.5/2.0, OpenSSL 0x0090602f
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Applying options for *
debug1: Rhosts Authentication disabled, originating port will not be trusted.
debug1: restore_uid
debug1: ssh_connect: getuid 500 geteuid 0 anon 1
debug1: Connecting to 192.168.200.37 [192.168.200.37] port 22.
debug1: temporarily_use_uid: 500/500 (e=0)
debug1: restore_uid
debug1: temporarily_use_uid: 500/500 (e=0)
debug1: restore_uid
debug1: Connection established.
debug1: read PEM private key done: type DSA
debug1: read PEM private key done: type RSA
debug1: identity file /home/enzo/.ssh/identity type -1
debug3: Not a RSA1 key file /home/enzo/.ssh/id_rsa.
debug2: key_type_from_name: unknown key type '-----BEGIN'
debug3: key_read: no key found
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug2: key_type_from_name: unknown key type '-----END'
debug3: key_read: no key found
debug1: identity file /home/enzo/.ssh/id_rsa type 1
debug1: identity file /home/enzo/.ssh/id_dsa type -1
debug1: Remote protocol version 2.0, remote software version OpenSSH_7.3
debug1: match: OpenSSH_7.3 pat OpenSSH*
Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_3.1p1
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug2: kex_parse_kexinit: diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: ssh-rsa,ssh-dss
debug2: kex_parse_kexinit: aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,aes192-cbc,aes256-cbc
debug2: kex_parse_kexinit: aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,aes192-cbc,aes256-cbc
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,hmac-ripemd160,[email protected],hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,hmac-ripemd160,[email protected],hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: none
debug2: kex_parse_kexinit: none
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit: first_kex_follows 0
debug2: kex_parse_kexinit: reserved 0
debug2: kex_parse_kexinit: [email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1
debug2: kex_parse_kexinit: ssh-rsa,rsa-sha2-512,rsa-sha2-256,ecdsa-sha2-nistp256,ssh-ed25519
debug2: kex_parse_kexinit: [email protected],aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected]
debug2: kex_parse_kexinit: [email protected],aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected]
debug2: kex_parse_kexinit: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: kex_parse_kexinit: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: kex_parse_kexinit: none,[email protected]
debug2: kex_parse_kexinit: none,[email protected]
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit: first_kex_follows 0
debug2: kex_parse_kexinit: reserved 0
no matching cipher found: client aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,aes192-cbc,aes256-cbc server [email protected],aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected]
debug1: Calling cleanup 0x80634c0(0x0)
서버에 이 알림이 있습니다
Dec 16 08:19:18 LinuxServer1 audit: CRYPTO_KEY_USER pid=27156 uid=0 auid=0 ses=9 msg='op=destroy kind=server fp=SHA256:b8:d0:f8:52:c7:21:3e:ff:fb:71:2f:f1:c5:f4:ac:76:1f:1c:5e:0d:e5:10:30:9a:c7:4a:de:1b:11:13:11:7b direction=? spid=27156 suid=0 exe="/usr/sbin/sshd" hostname=? addr=? terminal=? res=success'
Dec 16 08:19:18 LinuxServer1 audit: CRYPTO_KEY_USER pid=27156 uid=0 auid=0 ses=9 msg='op=destroy kind=server fp=SHA256:2b:3f:d0:85:0a:dd:78:0c:5a:4b:c4:eb:77:08:6e:ae:7a:8c:24:dc:52:cb:13:5d:d0:9d:c6:52:af:e9:a8:59 direction=? spid=27156 suid=0 exe="/usr/sbin/sshd" hostname=? addr=? terminal=? res=success'
Dec 16 08:19:18 LinuxServer1 audit: CRYPTO_KEY_USER pid=27156 uid=0 auid=0 ses=9 msg='op=destroy kind=server fp=SHA256:dc:75:c4:fd:90:f9:94:5a:b6:9e:d2:cc:04:68:f1:3a:cf:d0:f5:ad:a1:89:c5:a4:91:ef:50:42:ec:9e:a2:1d direction=? spid=27156 suid=0 exe="/usr/sbin/sshd" hostname=? addr=? terminal=? res=success'
==> secure <==
Dec 16 08:19:18 LinuxServer1 sshd[27155]: Unable to negotiate with 192.168.200.222 port 55702: no matching key exchange method found. Their offer: diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 [preauth]
==> messages <==
Dec 16 08:19:18 LinuxServer1 audit: CRYPTO_KEY_USER pid=27155 uid=0 auid=0 ses=9 msg='op=destroy kind=server fp=SHA256:dc:75:c4:fd:90:f9:94:5a:b6:9e:d2:cc:04:68:f1:3a:cf:d0:f5:ad:a1:89:c5:a4:91:ef:50:42:ec:9e:a2:1d direction=? spid=27156 suid=74 exe="/usr/sbin/sshd" hostname=? addr=? terminal=? res=success'
Dec 16 08:19:18 LinuxServer1 audit: CRYPTO_KEY_USER pid=27155 uid=0 auid=0 ses=9 msg='op=destroy kind=server fp=SHA256:b8:d0:f8:52:c7:21:3e:ff:fb:71:2f:f1:c5:f4:ac:76:1f:1c:5e:0d:e5:10:30:9a:c7:4a:de:1b:11:13:11:7b direction=? spid=27155 suid=0 exe="/usr/sbin/sshd" hostname=? addr=? terminal=? res=success'
Dec 16 08:19:18 LinuxServer1 audit: CRYPTO_KEY_USER pid=27155 uid=0 auid=0 ses=9 msg='op=destroy kind=server fp=SHA256:2b:3f:d0:85:0a:dd:78:0c:5a:4b:c4:eb:77:08:6e:ae:7a:8c:24:dc:52:cb:13:5d:d0:9d:c6:52:af:e9:a8:59 direction=? spid=27155 suid=0 exe="/usr/sbin/sshd" hostname=? addr=? terminal=? res=success'
Dec 16 08:19:18 LinuxServer1 audit: CRYPTO_KEY_USER pid=27155 uid=0 auid=0 ses=9 msg='op=destroy kind=server fp=SHA256:dc:75:c4:fd:90:f9:94:5a:b6:9e:d2:cc:04:68:f1:3a:cf:d0:f5:ad:a1:89:c5:a4:91:ef:50:42:ec:9e:a2:1d direction=? spid=27155 suid=0 exe="/usr/sbin/sshd" hostname=? addr=? terminal=? res=success'
Dec 16 08:19:18 LinuxServer1 audit: USER_LOGIN pid=27155 uid=0 auid=0 ses=9 msg='op=login acct="(unknown)" exe="/usr/sbin/sshd" hostname=? addr=192.168.200.222 terminal=ssh res=failed'
답변1
출력에서 클라이언트는 다음과 같은 암호 목록을 제공합니다.
debug2: kex_parse_kexinit: aes128-cbc, 3des-cbc, Blowfish-cbc, Cast128-cbc, arcfour, aes192-cbc, aes256-cbc
서버에 다음을 추가하세요.
디버그 2: kex_parse_kexinit:[이메일 보호됨],aes128-ctr,aes192-ctr,aes256-ctr,[이메일 보호됨],[이메일 보호됨]
교차점이 없음을 알 수 있습니다.
Openssh는 현재 기본적으로 암호화 모드를 제공하지 않지만 *-cbc이를 허용하도록 구성할 수 있습니다(실제 공격은 매우 정교함)
Match Host IP_of_the_legacy_client #can be omited
Ciphers +aes128-cbc,aes192-cbc,aes256-cbc
.sshd_config
키 교환 방법에도 비슷한 문제가 있습니다. 고객만 이용 가능
debug2: kex_parse_kexinit:diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1
그러나 서버에는 다른 설정이 있습니다.
디버그 2: kex_parse_kexinit:[이메일 보호됨],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14 -sha256,diffie-helman-group14-sha1
그러나 다시 말하지만, 이러한 방법은 현재 OpenSSH에 여전히 존재하며 다음에서 활성화할 수 있습니다 sshd_config.
KexAlgorithms +diffie-hellman-group-exchange-sha1
마지막으로 공통을 찾을 수 있는 MAC이 있으니 hmac-sha1문제는 없다.
자세한 내용은 다음을 참조하세요.OpenSSH 레거시 페이지.