OS2 World Community Forum
OS/2, eCS & ArcaOS - Technical => Applications => Topic started by: Greg Pringle on June 03, 2018, 01:48:46 pm
-
Using Alex Taylors build 5.3p1 and the latest from ArcaOS the OpenSSH will work for clients but has problems with SFtp.
Here is the log from sshd:
=====
debug1: Server will not fork when running in debugging mode.
Connection from 71.246.225.60 port 50909
debug1: Client protocol version 2.0; client software version JSCH-0.1.53
debug1: no match: JSCH-0.1.53
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_5.3
debug1: list_hostkey_types: ssh-rsa,ssh-dss
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: client->server aes128-ctr hmac-md5 none
debug1: kex: server->client aes128-ctr hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST received
debug1: File /etc/ssh/moduli -> C:/etc/ssh/moduli == /etc/ == UNIXROOT == ETC
debug1: File /etc/ssh/primes -> C:/etc/ssh/primes == /etc/ == UNIXROOT == ETC
WARNING: /etc/ssh/moduli does not exist, using fixed modulus
debug1: SSH2_MSG_KEX_DH_GEX_GROUP sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_INIT
Received disconnect from 71.246.225.60: 3: java.security.InvalidAlgorithmParamet
erException: Prime size must be multiple of 64, and can only range from 512 to 1
024 (inclusive)
debug1: do_cleanup
=====
Here is the log from an SFtp client:
=====
SFTP getList begin
getSession: root 71.246.225.60 22
good session
before connect
getList exc:com.jcraft.jsch.JSchException: Session.connect: java.security.Invali
dAlgorithmParameterException: Prime size must be multiple of 64, and can only ra
nge from 512 to 1024 (inclusive)
com.jcraft.jsch.JSchException: Session.connect: java.security.InvalidAlgorithmPa
rameterException: Prime size must be multiple of 64, and can only range from 512
to 1024 (inclusive)
at com.jcraft.jsch.Session.connect(Session.java:558)
at com.jcraft.jsch.Session.connect(Session.java:183)
at eforward.util.bin.SFtpClient.getList(SFtpClient.java)
at eforward.util.bin.SFtpClient.main(SFtpClient.java)
SFTP getList done
=====
Note there is a problem with the prime size.
Does anyone have any insight?
-
When I connect to OpenSSH 6.6p1-4.6 on Linux the sftp works.
I wonder if the version compiled for OS/2 is the problem.
-
WARNING: /etc/ssh/moduli does not exist, using fixed modulus
debug1: SSH2_MSG_KEX_DH_GEX_GROUP sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_INIT
Received disconnect from 71.246.225.60: 3: java.security.InvalidAlgorithmParamet
erException: Prime size must be multiple of 64, and can only range from 512 to 1
024 (inclusive)
This says it all: you don't have a 'moduli' file from which to pick a suitable prime number, so it's choosing from some builtin default value. However, the value it's using doesn't meet the client's criteria because it's (likely) too big.
The solution is to build a 'moduli' file with prime numbers of the right size (bit-width). The process is described here:
http://manpages.ubuntu.com/manpages/xenial/en/man1/ssh-keygen.1.html#contenttoc3 (http://manpages.ubuntu.com/manpages/xenial/en/man1/ssh-keygen.1.html#contenttoc3)
I used the example commands exactly as-is to generate 2048-bit prime numbers. The first run generated 57,003 "candidates" in a bit over 5 minutes. The second run took 47 minutes to confirm that 12 of them were in fact genuine prime numbers. Repeating this process using a bit-width in the range of 512 to 1024 should be a lot faster.
Note: I suspect that primes of "only" 512-1024 bits is probably considered low-end these days. Rather than being locked into a specific bit-width for all applications, you may want to run the generation process multiple times specifying differing widths, then combine the various output files into a single 'moduli' file.
UPDATE: I was just looking at the OpenSSH package from NetLabs and found that it has a ready-to-use moduli file with bit-widths from 1024 to 8192. A zip of the file is attached.
-
The moduli file made the error go away.
With that the the sshd_config file entry:
Subsystem sftp C:/usr/bin/sftp-server.exe
makes sftp function.
That allows sftp for the complete file system but I can find little to control the usage.
Then I tried:
Subsystem sftp internal-sftp
Match user greg
X11Forwarding no
AllowTcpForwarding no
ChrootDirectory /home
ForceCommand internal-sftp
but it does not want to work. If it worked then users could be bound to subdirectories for usage.
Here is the server error:
=====
subsystem request for sftp
debug1: subsystem: exec() internal-sftp
'ebug1: Forced command (config) 'internal-sftp
debug1: Received SIGCHLD.
=====