我必须更改我的旧 ssh 服务器。
旧的 sshd 是 OpenSSH_4.7p1，新的 sshd 是 OpenSSH_7.3p1。
我还有许多基于 Slackware 8.1 (2002) 的旧客户端以及非常旧的 ssh 客户端 OpenSSH_3.1p1
FROM : Linux P0101222 2.4.37.9_20130117
sshd: OpenSSH_3.1p1, SSH protocols 1.5/2.0, OpenSSL 0x0090602f
TO : Linux LinuxServer1 4.8.10-300.fc25.i686
sshd: OpenSSH_7.3p1, OpenSSL 1.0.2j-fips 26 Sep 2016
old sshd: OpenSSH_4.7p1, OpenSSL 0.9.8b 04 May 2006
我现在的问题是，由于使用了不同的密码，旧客户端无法连接到新的 ssh 服务器。
[enzo@P0101222 enzo]$ ssh 192.168.200.37
no matching cipher found:
client aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,
aes192-cbc,aes256-cbc server [email protected],
aes128-ctr,aes192-ctr,aes256-ctr,[email protected],
[email protected]
这是详细日志
[enzo@P0101222 enzo]$ ssh -v 192.168.200.37
OpenSSH_3.1p1, SSH protocols 1.5/2.0, OpenSSL 0x0090602f
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Applying options for *
debug1: Rhosts Authentication disabled,
originating port will not be trusted.
debug1: restore_uid
debug1: ssh_connect: getuid 500 geteuid 0 anon 1
debug1: Connecting to 192.168.200.37 [192.168.200.37] port 22.
debug1: temporarily_use_uid: 500/500 (e=0)
debug1: restore_uid
debug1: temporarily_use_uid: 500/500 (e=0)
debug1: restore_uid
debug1: Connection established.
debug1: read PEM private key done: type DSA
debug1: read PEM private key done: type RSA
debug1: identity file /home/enzo/.ssh/identity type -1
debug1: identity file /home/enzo/.ssh/id_rsa type 1
debug1: identity file /home/enzo/.ssh/id_dsa type -1
debug1: Remote protocol version 2.0,
remote software version OpenSSH_7.3
debug1: match: OpenSSH_7.3 pat OpenSSH*
Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_3.1p1
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
no matching cipher found: client aes128-cbc,
3des-cbc,blowfish-cbc,cast128-cbc,arcfour,aes192-cbc,
aes256-cbc server [email protected],aes128-ctr,
aes192-ctr,aes256-ctr,[email protected],
[email protected]
debug1: Calling cleanup 0x80634c0(0x0)
我的问题是是否可以管理旧客户端或者 sshd 服务器，以便允许客户端连接到新的 sshd 服务器
_____ 添加于 2016 年 12 月 15 日 09:18 ____
下面是更详细的日志。是的，对于我的任务，还应该可以在服务器端启用不太安全的服务器
[enzo@P0101222 enzo]$ ssh -vvv 192.168.200.37
OpenSSH_3.1p1, SSH protocols 1.5/2.0, OpenSSL 0x0090602f
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Applying options for *
debug1: Rhosts Authentication disabled, originating port will not be trusted.
debug1: restore_uid
debug1: ssh_connect: getuid 500 geteuid 0 anon 1
debug1: Connecting to 192.168.200.37 [192.168.200.37] port 22.
debug1: temporarily_use_uid: 500/500 (e=0)
debug1: restore_uid
debug1: temporarily_use_uid: 500/500 (e=0)
debug1: restore_uid
debug1: Connection established.
debug1: read PEM private key done: type DSA
debug1: read PEM private key done: type RSA
debug1: identity file /home/enzo/.ssh/identity type -1
debug3: Not a RSA1 key file /home/enzo/.ssh/id_rsa.
debug2: key_type_from_name: unknown key type '-----BEGIN'
debug3: key_read: no key found
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug2: key_type_from_name: unknown key type '-----END'
debug3: key_read: no key found
debug1: identity file /home/enzo/.ssh/id_rsa type 1
debug1: identity file /home/enzo/.ssh/id_dsa type -1
debug1: Remote protocol version 2.0, remote software version OpenSSH_7.3
debug1: match: OpenSSH_7.3 pat OpenSSH*
Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_3.1p1
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug2: kex_parse_kexinit: diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: ssh-rsa,ssh-dss
debug2: kex_parse_kexinit: aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,aes192-cbc,aes256-cbc
debug2: kex_parse_kexinit: aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,aes192-cbc,aes256-cbc
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,hmac-ripemd160,[email protected],hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,hmac-ripemd160,[email protected],hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: none
debug2: kex_parse_kexinit: none
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit: first_kex_follows 0
debug2: kex_parse_kexinit: reserved 0
debug2: kex_parse_kexinit: [email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1
debug2: kex_parse_kexinit: ssh-rsa,rsa-sha2-512,rsa-sha2-256,ecdsa-sha2-nistp256,ssh-ed25519
debug2: kex_parse_kexinit: [email protected],aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected]
debug2: kex_parse_kexinit: [email protected],aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected]
debug2: kex_parse_kexinit: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: kex_parse_kexinit: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: kex_parse_kexinit: none,[email protected]
debug2: kex_parse_kexinit: none,[email protected]
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit: first_kex_follows 0
debug2: kex_parse_kexinit: reserved 0
no matching cipher found: client aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,aes192-cbc,aes256-cbc server [email protected],aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected]
debug1: Calling cleanup 0x80634c0(0x0)
___ 添加于 16/12/2016 08:20 ____
感谢 Jakuje 的回答，但我又错过了一些东西。
我在末尾添加了建议的命令/etc/ssh/ssh_config 文件
[root@LinuxServer1 ssh]# cat /etc/ssh/ssh_config
...
Match Host IP_of_the_legacy_client #can be omited
Ciphers +aes128-cbc,aes192-cbc,aes256-cbc
KexAlgorithms +diffie-hellman-group-exchange-sha1
#
# To modify the system-wide ssh configuration, create a *.conf file under
# /etc/ssh/ssh_config.d/ which will be automatically included below
Include /etc/ssh/ssh_config.d/*.conf
`
但客户端无法连接
[enzo@P0101222 test]$ ssh -vvv 192.168.200.37
OpenSSH_3.1p1, SSH protocols 1.5/2.0, OpenSSL 0x0090602f
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Applying options for *
debug1: Rhosts Authentication disabled, originating port will not be trusted.
debug1: restore_uid
debug1: ssh_connect: getuid 500 geteuid 0 anon 1
debug1: Connecting to 192.168.200.37 [192.168.200.37] port 22.
debug1: temporarily_use_uid: 500/500 (e=0)
debug1: restore_uid
debug1: temporarily_use_uid: 500/500 (e=0)
debug1: restore_uid
debug1: Connection established.
debug1: read PEM private key done: type DSA
debug1: read PEM private key done: type RSA
debug1: identity file /home/enzo/.ssh/identity type -1
debug3: Not a RSA1 key file /home/enzo/.ssh/id_rsa.
debug2: key_type_from_name: unknown key type '-----BEGIN'
debug3: key_read: no key found
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug2: key_type_from_name: unknown key type '-----END'
debug3: key_read: no key found
debug1: identity file /home/enzo/.ssh/id_rsa type 1
debug1: identity file /home/enzo/.ssh/id_dsa type -1
debug1: Remote protocol version 2.0, remote software version OpenSSH_7.3
debug1: match: OpenSSH_7.3 pat OpenSSH*
Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_3.1p1
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug2: kex_parse_kexinit: diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: ssh-rsa,ssh-dss
debug2: kex_parse_kexinit: aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,aes192-cbc,aes256-cbc
debug2: kex_parse_kexinit: aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,aes192-cbc,aes256-cbc
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,hmac-ripemd160,[email protected],hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,hmac-ripemd160,[email protected],hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: none
debug2: kex_parse_kexinit: none
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit: first_kex_follows 0
debug2: kex_parse_kexinit: reserved 0
debug2: kex_parse_kexinit: [email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1
debug2: kex_parse_kexinit: ssh-rsa,rsa-sha2-512,rsa-sha2-256,ecdsa-sha2-nistp256,ssh-ed25519
debug2: kex_parse_kexinit: [email protected],aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected]
debug2: kex_parse_kexinit: [email protected],aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected]
debug2: kex_parse_kexinit: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: kex_parse_kexinit: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: kex_parse_kexinit: none,[email protected]
debug2: kex_parse_kexinit: none,[email protected]
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit: first_kex_follows 0
debug2: kex_parse_kexinit: reserved 0
no matching cipher found: client aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,aes192-cbc,aes256-cbc server [email protected],aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected]
debug1: Calling cleanup 0x80634c0(0x0)
在服务器上我有这个通知
Dec 16 08:19:18 LinuxServer1 audit: CRYPTO_KEY_USER pid=27156 uid=0 auid=0 ses=9 msg='op=destroy kind=server fp=SHA256:b8:d0:f8:52:c7:21:3e:ff:fb:71:2f:f1:c5:f4:ac:76:1f:1c:5e:0d:e5:10:30:9a:c7:4a:de:1b:11:13:11:7b direction=? spid=27156 suid=0 exe="/usr/sbin/sshd" hostname=? addr=? terminal=? res=success'
Dec 16 08:19:18 LinuxServer1 audit: CRYPTO_KEY_USER pid=27156 uid=0 auid=0 ses=9 msg='op=destroy kind=server fp=SHA256:2b:3f:d0:85:0a:dd:78:0c:5a:4b:c4:eb:77:08:6e:ae:7a:8c:24:dc:52:cb:13:5d:d0:9d:c6:52:af:e9:a8:59 direction=? spid=27156 suid=0 exe="/usr/sbin/sshd" hostname=? addr=? terminal=? res=success'
Dec 16 08:19:18 LinuxServer1 audit: CRYPTO_KEY_USER pid=27156 uid=0 auid=0 ses=9 msg='op=destroy kind=server fp=SHA256:dc:75:c4:fd:90:f9:94:5a:b6:9e:d2:cc:04:68:f1:3a:cf:d0:f5:ad:a1:89:c5:a4:91:ef:50:42:ec:9e:a2:1d direction=? spid=27156 suid=0 exe="/usr/sbin/sshd" hostname=? addr=? terminal=? res=success'
==> secure <==
Dec 16 08:19:18 LinuxServer1 sshd[27155]: Unable to negotiate with 192.168.200.222 port 55702: no matching key exchange method found. Their offer: diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 [preauth]
==> messages <==
Dec 16 08:19:18 LinuxServer1 audit: CRYPTO_KEY_USER pid=27155 uid=0 auid=0 ses=9 msg='op=destroy kind=server fp=SHA256:dc:75:c4:fd:90:f9:94:5a:b6:9e:d2:cc:04:68:f1:3a:cf:d0:f5:ad:a1:89:c5:a4:91:ef:50:42:ec:9e:a2:1d direction=? spid=27156 suid=74 exe="/usr/sbin/sshd" hostname=? addr=? terminal=? res=success'
Dec 16 08:19:18 LinuxServer1 audit: CRYPTO_KEY_USER pid=27155 uid=0 auid=0 ses=9 msg='op=destroy kind=server fp=SHA256:b8:d0:f8:52:c7:21:3e:ff:fb:71:2f:f1:c5:f4:ac:76:1f:1c:5e:0d:e5:10:30:9a:c7:4a:de:1b:11:13:11:7b direction=? spid=27155 suid=0 exe="/usr/sbin/sshd" hostname=? addr=? terminal=? res=success'
Dec 16 08:19:18 LinuxServer1 audit: CRYPTO_KEY_USER pid=27155 uid=0 auid=0 ses=9 msg='op=destroy kind=server fp=SHA256:2b:3f:d0:85:0a:dd:78:0c:5a:4b:c4:eb:77:08:6e:ae:7a:8c:24:dc:52:cb:13:5d:d0:9d:c6:52:af:e9:a8:59 direction=? spid=27155 suid=0 exe="/usr/sbin/sshd" hostname=? addr=? terminal=? res=success'
Dec 16 08:19:18 LinuxServer1 audit: CRYPTO_KEY_USER pid=27155 uid=0 auid=0 ses=9 msg='op=destroy kind=server fp=SHA256:dc:75:c4:fd:90:f9:94:5a:b6:9e:d2:cc:04:68:f1:3a:cf:d0:f5:ad:a1:89:c5:a4:91:ef:50:42:ec:9e:a2:1d direction=? spid=27155 suid=0 exe="/usr/sbin/sshd" hostname=? addr=? terminal=? res=success'
Dec 16 08:19:18 LinuxServer1 audit: USER_LOGIN pid=27155 uid=0 auid=0 ses=9 msg='op=login acct="(unknown)" exe="/usr/sbin/sshd" hostname=? addr=192.168.200.222 terminal=ssh res=failed'
答案1
从输出中，客户端提供了以下密码列表：
debug2：kex_parse_kexinit：aes128-cbc，3des-cbc，blowfish-cbc，cast128-cbc，arcfour，aes192-cbc，aes256-cbc
并服务器这个：
调试2：kex_parse_kexinit：[电子邮件受保护],aes128-ctr,aes192-ctr,aes256-ctr,[电子邮件受保护],[电子邮件受保护]
您可以注意到，没有交集。
目前的openssh默认不提供*-cbc密码模式，但是你可以配置它接受它们（真正的攻击非常复杂）
Match Host IP_of_the_legacy_client #can be omited
Ciphers +aes128-cbc,aes192-cbc,aes256-cbc
块在你的末尾sshd_config。
密钥交换方法也会遇到类似的问题。仅客户提供
debug2：kex_parse_kexinit：diffie-hellman-group-exchange-sha1，diffie-hellman-group1-sha1
但服务器有不同的设置：
调试2：kex_parse_kexinit：[电子邮件受保护],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14 -sha256，迪菲-赫尔曼-group14-sha1
但同样，这些方法仍然存在于当前的 OpenSSH 中，并且可以在以下位置启用sshd_config：
KexAlgorithms +diffie-hellman-group-exchange-sha1
最后就是MAC，可以找到commonhmac-sha1所以没有问题。
欲了解更多信息，请参阅OpenSSH 的旧版页面。