Release SuperZaxxon v1.76 SSH Login issues


Magic Sam

Forever Homebrew
Joined
Aug 10, 2007
Messages
2,535
Age
41
Location
Dogs in Space !
Hi all,

I can't easily log into my Pandora using ssh anymore:

samuel@portable:~$ ssh samuel@192.168.1.67
Unable to negotiate with 192.168.1.67 port 22: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1,diffie-hellman-group14-sha1

But this did the trick:

samuel@portable:~$ ssh -o KexAlgorithms=+diffie-hellman-group1-sha1 samuel@192.168.1.67
pandora:~$

I'm trying to connect from a Debian 10 x86_64 host:

OpenSSH_8.4p1 Debian-2~bpo10+1, OpenSSL 1.1.1d 10 Sep 2019

Is this still compatible with the older version we're running on the Pandora ?

OpenSSH_5.2p1, OpenSSL 0.9.8zh 3 Dec 2015

Am I the only one with that issue ? Should someone update OpenSSH / Dropbear / OpenSSL on the Pandora ?

Cheers, Magic Sam
 
The algorithm specification was required starting from some years ago.

I just tried with an updated Debian 9, and it worked without issues and no configuration at all, but OpenSSH is less recent.

What errors you can see ?

Have you already tried to add the algorithms to "/etc/ssh/ssh_config" or "~/.ssh/config" ?

EDIT:
I also tried with Cygwin that has SSH and SSL more recent than yours, and it connects without issues too.

This is what I have in the "~/.ssh/config" of Cygwin
Code:
Host 192.168.0.3
Port 22
KexAlgorithms +diffie-hellman-group1-sha1
Ciphers +3des-cbc
StrictHostKeyChecking no
UserKnownHostsFile=/dev/null
 
Last edited:
  • Like
Reactions: rSl
Hi all,

@PowerGod : this is the complete output in verbose mode:

samuel@portable:~$ ssh -vvv 192.168.1.67
OpenSSH_8.4p1 Debian-2~bpo10+1, OpenSSL 1.1.1d 10 Sep 2019
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: include /etc/ssh/ssh_config.d/*.conf matched no files
debug1: /etc/ssh/ssh_config line 21: Applying options for *
debug2: resolve_canonicalize: hostname 192.168.1.67 is address
debug3: expanded UserKnownHostsFile '~/.ssh/known_hosts' -> '/home/samuel/.ssh/known_hosts'
debug3: expanded UserKnownHostsFile '~/.ssh/known_hosts2' -> '/home/samuel/.ssh/known_hosts2'
debug2: ssh_connect_direct
debug1: Connecting to 192.168.1.67 [192.168.1.67] port 22.
debug1: Connection established.
debug1: identity file /home/samuel/.ssh/id_rsa type 0
debug1: identity file /home/samuel/.ssh/id_rsa-cert type -1
debug1: identity file /home/samuel/.ssh/id_dsa type -1
debug1: identity file /home/samuel/.ssh/id_dsa-cert type -1
debug1: identity file /home/samuel/.ssh/id_ecdsa type -1
debug1: identity file /home/samuel/.ssh/id_ecdsa-cert type -1
debug1: identity file /home/samuel/.ssh/id_ecdsa_sk type -1
debug1: identity file /home/samuel/.ssh/id_ecdsa_sk-cert type -1
debug1: identity file /home/samuel/.ssh/id_ed25519 type -1
debug1: identity file /home/samuel/.ssh/id_ed25519-cert type -1
debug1: identity file /home/samuel/.ssh/id_ed25519_sk type -1
debug1: identity file /home/samuel/.ssh/id_ed25519_sk-cert type -1
debug1: identity file /home/samuel/.ssh/id_xmss type -1
debug1: identity file /home/samuel/.ssh/id_xmss-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_8.4p1 Debian-2~bpo10+1
debug1: Remote protocol version 2.0, remote software version dropbear_0.53.1
debug1: no match: dropbear_0.53.1
debug2: fd 3 setting O_NONBLOCK
debug1: Authenticating to 192.168.1.67:22 as 'samuel'
debug3: hostkeys_foreach: reading file "/home/samuel/.ssh/known_hosts"
debug3: record_hostkey: found key type RSA in file /home/samuel/.ssh/known_hosts:19
debug3: load_hostkeys: loaded 1 keys from 192.168.1.67
debug3: order_hostkeyalgs: prefer hostkeyalgs: rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,rsa-sha2-512,rsa-sha2-256,ssh-rsa
debug3: send packet: type 20
debug1: SSH2_MSG_KEXINIT sent
debug3: receive packet: type 20
debug1: SSH2_MSG_KEXINIT received
debug2: local client KEXINIT proposal
debug2: KEX algorithms: curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,ext-info-c
debug2: host key algorithms: rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,sk-ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,sk-ecdsa-sha2-nistp256@openssh.com,ssh-ed25519,sk-ssh-ed25519@openssh.com
debug2: ciphers ctos: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com
debug2: ciphers stoc: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com
debug2: MACs ctos: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: MACs stoc: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: compression ctos: none,zlib@openssh.com,zlib
debug2: compression stoc: none,zlib@openssh.com,zlib
debug2: languages ctos:
debug2: languages stoc:
debug2: first_kex_follows 0
debug2: reserved 0
debug2: peer server KEXINIT proposal
debug2: KEX algorithms: diffie-hellman-group1-sha1,diffie-hellman-group14-sha1
debug2: host key algorithms: ssh-rsa
debug2: ciphers ctos: aes128-ctr,3des-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes256-cbc,twofish256-cbc,twofish-cbc,twofish128-cbc
debug2: ciphers stoc: aes128-ctr,3des-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes256-cbc,twofish256-cbc,twofish-cbc,twofish128-cbc
debug2: MACs ctos: hmac-sha1-96,hmac-sha1,hmac-md5
debug2: MACs stoc: hmac-sha1-96,hmac-sha1,hmac-md5
debug2: compression ctos: zlib,zlib@openssh.com,none
debug2: compression stoc: zlib,zlib@openssh.com,none
debug2: languages ctos:
debug2: languages stoc:
debug2: first_kex_follows 0
debug2: reserved 0
debug1: kex: algorithm: (no match)
Unable to negotiate with 192.168.1.67 port 22: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1,diffie-hellman-group14-sha1

I haven't tweaked SSH configuration files yet, but I think I will soon :)

Cheers, Magic Sam
 
Do you have a ~/.ssh/id_rsa file? I'm not quite sure whether -1 is true or false in that file, but id_rsa is marked as 0. Historically that would indicate to me that you're only got id_rsa and none of the newer ones, but these days it could be that that's been deprecated in favour of newer types. I recall I had to generate one of those on my box so that my Pandora could connect to it a few years ago. The actual logs ends in saying it's offered DH key exchange SHA 1 and it's perhaps not surprising that's not supported any more, but that combination of terms isn't actually known to me, so I'm not entirely sure what to make of it.
 
The issue seems here
Code:
debug2: KEX algorithms: curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,ext-info-c
because no one of these is listed:
Code:
diffie-hellman-group1-sha1,diffie-hellman-group14-sha1
 
After the last update of Cygwin I was unable to both connect to the Pandora from the PC and also the opposite...

I solved only one of the issues...
I can connect again from Cygwin to the Pandora after these changes:
  1. Added the PC RSA public key to the "~/.ssh/authorized_keys" file in the Pandora (before I was using a DSA key)
  2. Added these 2 lines in the "~/.ssh/config" on the PC, under the Pandora HOST configuration
    Code:
    HostKeyAlgorithms +ssh-rsa
    PubkeyAcceptedKeyTypes +ssh-rsa

Now I'm still struggling to find a way to make the Pandora to connect to the PC again.. I keep getting a "no hostkey alg" error, but all the configurations I tried are useless...

EDIT:

I DID IT !! ...but I'm not sure exactly how... I'll try to list all the things I changed, even if some of them probably did nothing...

To connect again from the Pandora to Cygwin i did these things:
  1. Generated a new pairs of RSA keys for the Pandora using PuttyGen and called them "id_rsa" and "id_rsa.pub"
  2. Added these 2 lines in the "~/.ssh/config" on the Pandora
    Code:
    HostKeyAlgorithms ssh-rsa,ssh-dss
    IdentityFile pkcs11:~/.ssh/id_rsa
  3. Added these 4 lines in the "/etc/sshd_config" of Cygwin (the Hostkey ones where already there but commented)
    Code:
    PubkeyAcceptedKeyTypes ssh-rsa,ssh-dss
    HostKeyAlgorithms ssh-rsa,ssh-dss
    HostKey /etc/ssh_host_rsa_key
    HostKey /etc/ssh_host_dsa_key
  4. re-checked permissions of all the ssh config thing related files

EDIT2:

I tried to go back on my steps to find out what actually worked, and seems it was just this
  • Added this line in the "/etc/sshd_config" of Cygwin
    Code:
    HostKeyAlgorithms ssh-rsa,ssh-dss
 
Last edited:
Yes, seems like the Cygwin server wasn't providing a list of host algorithms... but I never had to specify them before.

So, not providing that list was creating issues both as a client and as a server.

Now I also restored the previous config on the Pandora (and removed also the new RSA keys), it works without issues as before...

In the end this line on Cygwin "sshd_config" solved everything:
Code:
HostKeyAlgorithms ssh-rsa,ssh-dss

and is needed also to be specified in the Cygwin "~/.ssh/config" for connecting to the Pandora
Code:
HostKeyAlgorithms +ssh-rsa
PubkeyAcceptedKeyTypes +ssh-rsa
or it gives this error:
Code:
Unable to negotiate with 192.168.1.3 port 22: no matching host key type found. Their offer: ssh-rsa
 
Last edited:
This is the year that I booted up my pandora and realized it couldnt ssh (or be ssh'd from) modernly configured systems - which is obvious if you've been on the loop with changes to openssh, those RSA algos that internally use SHA1 got replaced with ones that use SHA256 (just saying this so ya'll know that your RSA keys are just fine to still use).

Anyways, I revived my old dchrt-ng container, pointed the dropbear PNDBUILD to a dropbear from 2022, and got this:

If you opkg install that file on the pandora OS and reboot, you should have a ssh server that you can connect to without any special configuration
(NO WARRANTY as usual tho, I've minimally tested that it seems to run and connect but thats it.).

Note: This does not change the default "ssh" client on the pandora, that comes from OpenSSH, BUT
dropbear does come with its own client named "dbclient" that works just fine, so you can eg. alias ssh=dbclient

The dropbear client is not aware of the usual .ssh/id_rsa* keyfiles, so if you use those to identifiy, you will need to dropbearconvert your key into .ssh/id_dropbear.
 
Back
Top