ssh – Co się zmieniło? ubuntu-16.04.3-desktop-amd64

[k2kk]

Witam
Zainstalowałem ubuntu-16.04.3-desktop-amd64
Skopiowałem katalog .ssh z wersji ubuntu-Triumfalna-Turkawka-14.04.1PL-DVD-amd64
mam zawartość katalogu
ls -lh .ssh/
-rw-r–r– 1 xx xx 617 lis 17 04:04 authorized_keys
-rw——- 1 xx xx 668 lis 17 04:04 id_dsa
-rw-r–r– 1 xx xx 595 lis 17 04:04 id_dsa.pub
-rw-r–r– 1 xx xx 5,6K gru 15 04:16 known_hosts

Przestało działać logowanie na inne maszyny ( komputery ) bez hasła.

Nie wiem co się zmieniło – Czy ktoś ma jakiś pomysł ?

[jacekalex]

Kod: Zaznacz cały

ssh -v user@host

i napisze w powłoce, co go boli.

Na początek popraw uprawnienia:

Kod: Zaznacz cały

chmod 700 .ssh/
chmod 600 .ssh/*

SSH jest bardzo wrażliwy na system uprawnień do folderów i kluczy.

[k2kk]

zmieniłem uprawnienia teraz są
ls -lh .ssh/
-rw--–-– 1 xx xx 617 lis 17 04:04 authorized_keys
-rw--—- 1 xx xx 668 lis 17 04:04 id_dsa
-rw--–-– 1 xx xx 595 lis 17 04:04 id_dsa.pub
-rw--–-– 1 xx xx 5,6K gru 15 04:16 known_hosts
dalej nie

ubuntu-Triumfalna-Turkawka-14.04.1PL-DVD-amd64
k@d:~$ ssh s -v
OpenSSH_6.6.1, OpenSSL 1.0.1f 6 Jan 2014
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug1: Connecting to s [1.1.1.1] port 22.
debug1: Connection established.
debug1: identity file /home/k/.ssh/id_rsa type -1
debug1: identity file /home/k/.ssh/id_rsa-cert type -1
debug1: identity file /home/k/.ssh/id_dsa type 2
debug1: identity file /home/k/.ssh/id_dsa-cert type -1
debug1: identity file /home/k/.ssh/id_ecdsa type -1
debug1: identity file /home/k/.ssh/id_ecdsa-cert type -1
debug1: identity file /home/k/.ssh/id_ed25519 type -1
debug1: identity file /home/k/.ssh/id_ed25519-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.6.1p1 Ubuntu-2ubuntu2
debug1: Remote protocol version 2.0, remote software version OpenSSH_4.7
debug1: match: OpenSSH_4.7 pat OpenSSH_4* compat 0x00000000
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-ctr hmac-md5 none
debug1: kex: client->server aes128-ctr hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<3072<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
debug1: Server host key: RSA 0b:74:52:13:4d:0a:ea:25ba:14:44:28:3c:d5:79
debug1: Host 'saturn' is known and matches the RSA host key.
debug1: Found key in /home/k/.ssh/known_hosts:2
debug1: ssh_rsa_verify: signature correct
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: Roaming not allowed by server
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,password,keyboard-interactive
debug1: Next authentication method: publickey
debug1: Offering DSA public key: /home/k/.ssh/id_dsa
debug1: Server accepts key: pkalg ssh-dss blen 434
debug1: Authentication succeeded (publickey).
Authenticated to saturn ([1.1.1.1]:22).
debug1: channel 0: new [client-session]
debug1: Entering interactive session.
debug1: Requesting X11 forwarding with authentication spoofing.
debug1: Sending environment.
debug1: Sending env LANG = pl_PL.UTF-8
Last login: Tue Dec 19 03:33:16 2017 from dom
!k@s ~!$

ubuntu-16.04.3-desktop-amd64
k@d:~$ ssh k@s -v
OpenSSH_7.2p2 Ubuntu-4ubuntu2.2, OpenSSL 1.0.2g 1 Mar 2016
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug1: Connecting to s [1.1.1.1] port 22.
debug1: Connection established.
debug1: key_load_public: No such file or directory
debug1: identity file /home/k/.ssh/id_rsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/k/.ssh/id_rsa-cert type -1
debug1: identity file /home/k/.ssh/id_dsa type 2
debug1: key_load_public: No such file or directory
debug1: identity file /home/k/.ssh/id_dsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/k/.ssh/id_ecdsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/k/.ssh/id_ecdsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/k/.ssh/id_ed25519 type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/k/.ssh/id_ed25519-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_7.2p2 Ubuntu-4ubuntu2.2
debug1: Remote protocol version 2.0, remote software version OpenSSH_4.7
debug1: match: OpenSSH_4.7 pat OpenSSH_4* compat 0x00000000
debug1: Authenticating to s:22 as 'k'
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: algorithm: diffie-hellman-group-exchange-sha256
debug1: kex: host key algorithm: ssh-rsa
debug1: kex: server->client cipher: aes128-ctr MAC: umac-64@openssh.com compression: none
debug1: kex: client->server cipher: aes128-ctr MAC: umac-64@openssh.com compression: none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(2048<3072<8192) sent
debug1: got SSH2_MSG_KEX_DH_GEX_GROUP
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: got SSH2_MSG_KEX_DH_GEX_REPLY
debug1: Server host key: ssh-rsa SHA256:ha6nWpTIpeSqp8osrterbBZnCgSzNtha5Yyk4LLg6OY
debug1: Host 's' is known and matches the RSA host key.
debug1: Found key in /home/k/.ssh/known_hosts:2
debug1: rekey after 4294967296 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: rekey after 4294967296 blocks
debug1: SSH2_MSG_NEWKEYS received
debug1: Skipping ssh-dss key /home/k/.ssh/id_dsa - not in PubkeyAcceptedKeyTypes
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,password,keyboard-interactive
debug1: Next authentication method: publickey
debug1: Trying private key: /home/k/.ssh/id_rsa
debug1: Trying private key: /home/k/.ssh/id_ecdsa
debug1: Trying private key: /home/k/.ssh/id_ed25519
debug1: Next authentication method: keyboard-interactive
debug1: Authentications that can continue: publickey,password,keyboard-interactive
debug1: Next authentication method: password
k@s password:






na razie wygenerowałem klucz id_rsa(.pub) to rozwiązało jakoś problem ale klucz id_dsa(.pub) nie działa

[jacekalex]

Kod: Zaznacz cały

debug1: Skipping ssh-dss key /home/k/.ssh/id_dsa - not in PubkeyAcceptedKeyTypes

Dziwny ten komunikat, pierwszy raz widzę coś podobnego.

Spróbuj od nowa wygenerować klucz dsa, o jakieś większej długości.
np tak:

Kod: Zaznacz cały

ssh-keygen -t dsa -f .ssh/test.dsa -b 1024

Poza tym masz chyba jakąś zabytkową wersję SSH, aktualnie w Debianie jest:

Kod: Zaznacz cały

apt-cache policy openssh-server
openssh-server:
  Zainstalowana: 1:7.6p1-2
  Kandydująca:   1:7.6p1-2
  Tabela wersji:
 *** 1:7.6p1-2 990
        990 https://deb.debian.org/debian testing/main amd64 Packages
        500 https://deb.debian.org/debian unstable/main amd64 Packages
        100 /var/lib/dpkg/status
     1:7.4p1-10+deb9u2 500
        500 https://deb.debian.org/debian stable/main amd64 Packages

Pamiętam, że wszystkie wersje OpenSSH poniżej 7.3 miały jakiś katastrofalny błąd bezpieczeństwa,
i z Debiana czy Gentoo wyleciały z wielkim hukiem.

Tu masz szczegóły:
https://security.gentoo.org/glsa/201612-18

PS:
Może nie jest aż tak strasznie, z oldoldoldstable Debiana openssh-6 jeszcze nie poleciało całkiem (czyli są jakieś załatane wersje):
https://packages.debian.org/search?keyw ... ssh-server


Pozdro

[k2kk]

są to próby zalogowania do Mandrivy 2008.1 - OpenSSH_4.7p1, OpenSSL 0.9.8g 19 Oct 2007
to prawda archiwum ale działa

generowanie nowego klucza spróbuję wieczorem

[k2kk]

dzięki za pomoc
ale dopiero dział <PubkeyAcceptedKeyTypes +ssh-dss> dodane do /etc/ssh/ssh_config