以前のSSHサーバーを変更する必要があります。
古い sshd は OpenSSH_4.7p1 で、新しい sshd は OpenSSH_7.3p1 です。
私はまた、Slackware 8.1（2002）に基づく多数の古いクライアントと非常に古いSSHクライアントであるOpenSSH_3.1p1を持っています。
FROM : Linux P0101222 2.4.37.9_20130117
sshd: OpenSSH_3.1p1, SSH protocols 1.5/2.0, OpenSSL 0x0090602f
TO : Linux LinuxServer1 4.8.10-300.fc25.i686
sshd: OpenSSH_7.3p1, OpenSSL 1.0.2j-fips 26 Sep 2016
old sshd: OpenSSH_4.7p1, OpenSSL 0.9.8b 04 May 2006
私の問題は、別のパスワードを使用しているため、古いクライアントが新しいSSHサーバーに接続できないことです。
[enzo@P0101222 enzo]$ ssh 192.168.200.37
no matching cipher found:
client aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,
aes192-cbc,aes256-cbc server [email protected],
aes128-ctr,aes192-ctr,aes256-ctr,[email protected],
[email protected]
詳細なログです
[enzo@P0101222 enzo]$ ssh -v 192.168.200.37
OpenSSH_3.1p1, SSH protocols 1.5/2.0, OpenSSL 0x0090602f
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Applying options for *
debug1: Rhosts Authentication disabled,
originating port will not be trusted.
debug1: restore_uid
debug1: ssh_connect: getuid 500 geteuid 0 anon 1
debug1: Connecting to 192.168.200.37 [192.168.200.37] port 22.
debug1: temporarily_use_uid: 500/500 (e=0)
debug1: restore_uid
debug1: temporarily_use_uid: 500/500 (e=0)
debug1: restore_uid
debug1: Connection established.
debug1: read PEM private key done: type DSA
debug1: read PEM private key done: type RSA
debug1: identity file /home/enzo/.ssh/identity type -1
debug1: identity file /home/enzo/.ssh/id_rsa type 1
debug1: identity file /home/enzo/.ssh/id_dsa type -1
debug1: Remote protocol version 2.0,
remote software version OpenSSH_7.3
debug1: match: OpenSSH_7.3 pat OpenSSH*
Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_3.1p1
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
no matching cipher found: client aes128-cbc,
3des-cbc,blowfish-cbc,cast128-cbc,arcfour,aes192-cbc,
aes256-cbc server [email protected],aes128-ctr,
aes192-ctr,aes256-ctr,[email protected],
[email protected]
debug1: Calling cleanup 0x80634c0(0x0)
私の質問は、クライアントが新しいsshdサーバーに接続できるように、古いクライアントまたはsshdサーバーを管理することができることです。
_____ 2016年12月15日09:18に追加しました____
以下はもう少し詳細なログです。はい、私の仕事のためにサーバー側で安全性の低いサーバーを有効にすることも可能です。
[enzo@P0101222 enzo]$ ssh -vvv 192.168.200.37
OpenSSH_3.1p1, SSH protocols 1.5/2.0, OpenSSL 0x0090602f
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Applying options for *
debug1: Rhosts Authentication disabled, originating port will not be trusted.
debug1: restore_uid
debug1: ssh_connect: getuid 500 geteuid 0 anon 1
debug1: Connecting to 192.168.200.37 [192.168.200.37] port 22.
debug1: temporarily_use_uid: 500/500 (e=0)
debug1: restore_uid
debug1: temporarily_use_uid: 500/500 (e=0)
debug1: restore_uid
debug1: Connection established.
debug1: read PEM private key done: type DSA
debug1: read PEM private key done: type RSA
debug1: identity file /home/enzo/.ssh/identity type -1
debug3: Not a RSA1 key file /home/enzo/.ssh/id_rsa.
debug2: key_type_from_name: unknown key type '-----BEGIN'
debug3: key_read: no key found
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug2: key_type_from_name: unknown key type '-----END'
debug3: key_read: no key found
debug1: identity file /home/enzo/.ssh/id_rsa type 1
debug1: identity file /home/enzo/.ssh/id_dsa type -1
debug1: Remote protocol version 2.0, remote software version OpenSSH_7.3
debug1: match: OpenSSH_7.3 pat OpenSSH*
Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_3.1p1
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug2: kex_parse_kexinit: diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: ssh-rsa,ssh-dss
debug2: kex_parse_kexinit: aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,aes192-cbc,aes256-cbc
debug2: kex_parse_kexinit: aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,aes192-cbc,aes256-cbc
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,hmac-ripemd160,[email protected],hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,hmac-ripemd160,[email protected],hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: none
debug2: kex_parse_kexinit: none
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit: first_kex_follows 0
debug2: kex_parse_kexinit: reserved 0
debug2: kex_parse_kexinit: [email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1
debug2: kex_parse_kexinit: ssh-rsa,rsa-sha2-512,rsa-sha2-256,ecdsa-sha2-nistp256,ssh-ed25519
debug2: kex_parse_kexinit: [email protected],aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected]
debug2: kex_parse_kexinit: [email protected],aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected]
debug2: kex_parse_kexinit: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: kex_parse_kexinit: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: kex_parse_kexinit: none,[email protected]
debug2: kex_parse_kexinit: none,[email protected]
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit: first_kex_follows 0
debug2: kex_parse_kexinit: reserved 0
no matching cipher found: client aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,aes192-cbc,aes256-cbc server [email protected],aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected]
debug1: Calling cleanup 0x80634c0(0x0)
___ 2016年16月12日08:20に追加されました____
答えてくれたJakujeに感謝します。しかし、もう一つ逃した部分があります。
最後に提案されたコマンドを追加しました/etc/ssh/ssh_config ファイル
[root@LinuxServer1 ssh]# cat /etc/ssh/ssh_config
...
Match Host IP_of_the_legacy_client #can be omited
Ciphers +aes128-cbc,aes192-cbc,aes256-cbc
KexAlgorithms +diffie-hellman-group-exchange-sha1
#
# To modify the system-wide ssh configuration, create a *.conf file under
# /etc/ssh/ssh_config.d/ which will be automatically included below
Include /etc/ssh/ssh_config.d/*.conf
`
ただし、クライアントは接続できません。
[enzo@P0101222 test]$ ssh -vvv 192.168.200.37
OpenSSH_3.1p1, SSH protocols 1.5/2.0, OpenSSL 0x0090602f
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Applying options for *
debug1: Rhosts Authentication disabled, originating port will not be trusted.
debug1: restore_uid
debug1: ssh_connect: getuid 500 geteuid 0 anon 1
debug1: Connecting to 192.168.200.37 [192.168.200.37] port 22.
debug1: temporarily_use_uid: 500/500 (e=0)
debug1: restore_uid
debug1: temporarily_use_uid: 500/500 (e=0)
debug1: restore_uid
debug1: Connection established.
debug1: read PEM private key done: type DSA
debug1: read PEM private key done: type RSA
debug1: identity file /home/enzo/.ssh/identity type -1
debug3: Not a RSA1 key file /home/enzo/.ssh/id_rsa.
debug2: key_type_from_name: unknown key type '-----BEGIN'
debug3: key_read: no key found
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug2: key_type_from_name: unknown key type '-----END'
debug3: key_read: no key found
debug1: identity file /home/enzo/.ssh/id_rsa type 1
debug1: identity file /home/enzo/.ssh/id_dsa type -1
debug1: Remote protocol version 2.0, remote software version OpenSSH_7.3
debug1: match: OpenSSH_7.3 pat OpenSSH*
Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_3.1p1
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug2: kex_parse_kexinit: diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: ssh-rsa,ssh-dss
debug2: kex_parse_kexinit: aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,aes192-cbc,aes256-cbc
debug2: kex_parse_kexinit: aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,aes192-cbc,aes256-cbc
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,hmac-ripemd160,[email protected],hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,hmac-ripemd160,[email protected],hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: none
debug2: kex_parse_kexinit: none
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit: first_kex_follows 0
debug2: kex_parse_kexinit: reserved 0
debug2: kex_parse_kexinit: [email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1
debug2: kex_parse_kexinit: ssh-rsa,rsa-sha2-512,rsa-sha2-256,ecdsa-sha2-nistp256,ssh-ed25519
debug2: kex_parse_kexinit: [email protected],aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected]
debug2: kex_parse_kexinit: [email protected],aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected]
debug2: kex_parse_kexinit: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: kex_parse_kexinit: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: kex_parse_kexinit: none,[email protected]
debug2: kex_parse_kexinit: none,[email protected]
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit: first_kex_follows 0
debug2: kex_parse_kexinit: reserved 0
no matching cipher found: client aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,aes192-cbc,aes256-cbc server [email protected],aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected]
debug1: Calling cleanup 0x80634c0(0x0)
サーバーにこの通知があります
Dec 16 08:19:18 LinuxServer1 audit: CRYPTO_KEY_USER pid=27156 uid=0 auid=0 ses=9 msg='op=destroy kind=server fp=SHA256:b8:d0:f8:52:c7:21:3e:ff:fb:71:2f:f1:c5:f4:ac:76:1f:1c:5e:0d:e5:10:30:9a:c7:4a:de:1b:11:13:11:7b direction=? spid=27156 suid=0 exe="/usr/sbin/sshd" hostname=? addr=? terminal=? res=success'
Dec 16 08:19:18 LinuxServer1 audit: CRYPTO_KEY_USER pid=27156 uid=0 auid=0 ses=9 msg='op=destroy kind=server fp=SHA256:2b:3f:d0:85:0a:dd:78:0c:5a:4b:c4:eb:77:08:6e:ae:7a:8c:24:dc:52:cb:13:5d:d0:9d:c6:52:af:e9:a8:59 direction=? spid=27156 suid=0 exe="/usr/sbin/sshd" hostname=? addr=? terminal=? res=success'
Dec 16 08:19:18 LinuxServer1 audit: CRYPTO_KEY_USER pid=27156 uid=0 auid=0 ses=9 msg='op=destroy kind=server fp=SHA256:dc:75:c4:fd:90:f9:94:5a:b6:9e:d2:cc:04:68:f1:3a:cf:d0:f5:ad:a1:89:c5:a4:91:ef:50:42:ec:9e:a2:1d direction=? spid=27156 suid=0 exe="/usr/sbin/sshd" hostname=? addr=? terminal=? res=success'
==> secure <==
Dec 16 08:19:18 LinuxServer1 sshd[27155]: Unable to negotiate with 192.168.200.222 port 55702: no matching key exchange method found. Their offer: diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 [preauth]
==> messages <==
Dec 16 08:19:18 LinuxServer1 audit: CRYPTO_KEY_USER pid=27155 uid=0 auid=0 ses=9 msg='op=destroy kind=server fp=SHA256:dc:75:c4:fd:90:f9:94:5a:b6:9e:d2:cc:04:68:f1:3a:cf:d0:f5:ad:a1:89:c5:a4:91:ef:50:42:ec:9e:a2:1d direction=? spid=27156 suid=74 exe="/usr/sbin/sshd" hostname=? addr=? terminal=? res=success'
Dec 16 08:19:18 LinuxServer1 audit: CRYPTO_KEY_USER pid=27155 uid=0 auid=0 ses=9 msg='op=destroy kind=server fp=SHA256:b8:d0:f8:52:c7:21:3e:ff:fb:71:2f:f1:c5:f4:ac:76:1f:1c:5e:0d:e5:10:30:9a:c7:4a:de:1b:11:13:11:7b direction=? spid=27155 suid=0 exe="/usr/sbin/sshd" hostname=? addr=? terminal=? res=success'
Dec 16 08:19:18 LinuxServer1 audit: CRYPTO_KEY_USER pid=27155 uid=0 auid=0 ses=9 msg='op=destroy kind=server fp=SHA256:2b:3f:d0:85:0a:dd:78:0c:5a:4b:c4:eb:77:08:6e:ae:7a:8c:24:dc:52:cb:13:5d:d0:9d:c6:52:af:e9:a8:59 direction=? spid=27155 suid=0 exe="/usr/sbin/sshd" hostname=? addr=? terminal=? res=success'
Dec 16 08:19:18 LinuxServer1 audit: CRYPTO_KEY_USER pid=27155 uid=0 auid=0 ses=9 msg='op=destroy kind=server fp=SHA256:dc:75:c4:fd:90:f9:94:5a:b6:9e:d2:cc:04:68:f1:3a:cf:d0:f5:ad:a1:89:c5:a4:91:ef:50:42:ec:9e:a2:1d direction=? spid=27155 suid=0 exe="/usr/sbin/sshd" hostname=? addr=? terminal=? res=success'
Dec 16 08:19:18 LinuxServer1 audit: USER_LOGIN pid=27155 uid=0 auid=0 ses=9 msg='op=login acct="(unknown)" exe="/usr/sbin/sshd" hostname=? addr=192.168.200.222 terminal=ssh res=failed'
ベストアンサー1
出力では、クライアントは次のパスワードのリストを提供します。
debug2: kex_parse_kexinit: aes128-cbc, 3des-cbc, Blowfish-cbc, Cast128-cbc, arcfour, aes192-cbc, aes256-cbc
サーバーに以下を追加します。
デバッグ 2: kex_parse_kexinit:[Eメール保護],aes128-ctr,aes192-ctr,aes256-ctr,[Eメール保護]、[Eメール保護]
交差点がないことがわかります。
Opensshは現在デフォルトで暗号化モードを提供していませんが、*-cbcこれを許可するように設定できます（実際の攻撃は非常に洗練されています）
Match Host IP_of_the_legacy_client #can be omited
Ciphers +aes128-cbc,aes192-cbc,aes256-cbc
sshd_config.
鍵交換方法にも同様の問題があります。お客様のみ利用可能
debug2: kex_parse_kexinit:diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1
ただし、サーバーには異なる設定があります。
デバッグ 2: kex_parse_kexinit:[Eメール保護],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie -sha256,diffie-helman-group14-sha1
しかし、やはり、これらの方法は現在OpenSSHにまだ存在しており、以下で有効にすることができますsshd_config。
KexAlgorithms +diffie-hellman-group-exchange-sha1
最後に共通を見つけることができるMACがあるのでhmac-sha1問題はない。
詳細については、次を参照してください。OpenSSH レガシーページ。