Author Topic: OpenSSH configuration problem  (Read 1013 times)

Greg Pringle

  • Full Member
  • ***
  • Thank You
  • -Given: 6
  • -Receive: 2
  • Posts: 114
    • View Profile
OpenSSH configuration problem
« on: June 03, 2018, 01:48:46 pm »
Using Alex Taylors build 5.3p1 and the latest from ArcaOS the OpenSSH will work for clients but has problems with SFtp.

Here is the log from sshd:
=====
debug1: Server will not fork when running in debugging mode.
Connection from 71.246.225.60 port 50909
debug1: Client protocol version 2.0; client software version JSCH-0.1.53
debug1: no match: JSCH-0.1.53
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_5.3
debug1: list_hostkey_types: ssh-rsa,ssh-dss
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: client->server aes128-ctr hmac-md5 none
debug1: kex: server->client aes128-ctr hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST received
debug1: File /etc/ssh/moduli -> C:/etc/ssh/moduli == /etc/ == UNIXROOT == ETC

debug1: File /etc/ssh/primes -> C:/etc/ssh/primes == /etc/ == UNIXROOT == ETC

WARNING: /etc/ssh/moduli does not exist, using fixed modulus
debug1: SSH2_MSG_KEX_DH_GEX_GROUP sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_INIT
Received disconnect from 71.246.225.60: 3: java.security.InvalidAlgorithmParamet
erException: Prime size must be multiple of 64, and can only range from 512 to 1
024 (inclusive)
debug1: do_cleanup
=====

Here is the log from an SFtp client:
=====
SFTP getList begin
getSession: root 71.246.225.60 22
good session
before connect
getList exc:com.jcraft.jsch.JSchException: Session.connect: java.security.Invali
dAlgorithmParameterException: Prime size must be multiple of 64, and can only ra
nge from 512 to 1024 (inclusive)
com.jcraft.jsch.JSchException: Session.connect: java.security.InvalidAlgorithmPa
rameterException: Prime size must be multiple of 64, and can only range from 512
 to 1024 (inclusive)
        at com.jcraft.jsch.Session.connect(Session.java:558)
        at com.jcraft.jsch.Session.connect(Session.java:183)
        at eforward.util.bin.SFtpClient.getList(SFtpClient.java)
        at eforward.util.bin.SFtpClient.main(SFtpClient.java)
SFTP getList done
=====

Note there is a problem with the prime size.

Does anyone have any insight?


Greg Pringle

  • Full Member
  • ***
  • Thank You
  • -Given: 6
  • -Receive: 2
  • Posts: 114
    • View Profile
Re: OpenSSH configuration problem
« Reply #1 on: June 04, 2018, 03:43:51 pm »
When I connect to OpenSSH 6.6p1-4.6 on Linux the sftp works.

I wonder if the version compiled for OS/2 is the problem.

Rich Walsh

  • Jr. Member
  • **
  • Thank You
  • -Given: 1
  • -Receive: 11
  • Posts: 96
  • ONU! (OS/2 is NOT Unix!)
    • View Profile
Re: OpenSSH configuration problem
« Reply #2 on: June 04, 2018, 08:20:41 pm »
WARNING: /etc/ssh/moduli does not exist, using fixed modulus
debug1: SSH2_MSG_KEX_DH_GEX_GROUP sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_INIT
Received disconnect from 71.246.225.60: 3: java.security.InvalidAlgorithmParamet
erException: Prime size must be multiple of 64, and can only range from 512 to 1
024 (inclusive)

This says it all: you don't have a 'moduli' file from which to pick a suitable prime number, so it's choosing from some builtin default value. However, the value it's using doesn't meet the client's criteria because it's (likely) too big.

The solution is to build a 'moduli' file with prime numbers of the right size (bit-width). The process is described here:
http://manpages.ubuntu.com/manpages/xenial/en/man1/ssh-keygen.1.html#contenttoc3

I used the example commands exactly as-is to generate 2048-bit prime numbers. The first run generated 57,003 "candidates" in a bit over 5 minutes. The second run took 47 minutes to confirm that 12 of them were in fact genuine prime numbers. Repeating this process using a bit-width in the range of 512 to 1024 should be a lot faster.

Note: I suspect that primes of "only" 512-1024 bits is probably considered low-end these days. Rather than being locked into a specific bit-width for all applications, you may want to run the generation process multiple times specifying differing widths, then combine the various output files into a single 'moduli' file.

UPDATE: I was just looking at the OpenSSH package from NetLabs and found that it has a ready-to-use moduli file with bit-widths from 1024 to 8192. A zip of the file is attached.
« Last Edit: June 05, 2018, 05:57:43 am by Rich Walsh »

Greg Pringle

  • Full Member
  • ***
  • Thank You
  • -Given: 6
  • -Receive: 2
  • Posts: 114
    • View Profile
Re: OpenSSH configuration problem
« Reply #3 on: June 05, 2018, 03:30:03 pm »
The moduli file made the error go away.

With that the the sshd_config file entry:
Subsystem       sftp    C:/usr/bin/sftp-server.exe

makes sftp function.

That allows sftp for the complete file system but I can find little to control the usage.
Then I tried:
Subsystem       sftp    internal-sftp
Match user greg
        X11Forwarding no
        AllowTcpForwarding no
        ChrootDirectory /home
        ForceCommand internal-sftp

but it does not want to work. If it worked then users could be bound to subdirectories for usage.
Here is the server error:
=====
subsystem request for sftp
debug1: subsystem: exec() internal-sftp
'ebug1: Forced command (config) 'internal-sftp
debug1: Received SIGCHLD.
=====