 |
かなりハマって検索しまくってやっと以下に至りました。
接続先 : delegate2 FreeBSD 4.11 RELEASE ssh ver OpenSSH_3.5p1
接続元 : q4os-v200 q4os 5.10 (debian 12) ssh ver OpenSSH_9.2p1
# 接続してみた。
takaq@q4os-v200:~$ ssh takaq@delegate2
Unable to negotiate with 192.168.1.9 port 22: no matching key exchange method found. Their offer: diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1
# 鍵交換方法の指定をする。
takaq@q4os-v200:~$ ssh delegate2 -oKexAlgorithms=diffie-hellman-group-exchange-sha1
Unable to negotiate with 192.168.1.9 port 22: no matching host key type found. Their offer: ssh-dss
# OpenSSH の 7.0 から DSA(ssh-dss) の脆弱性により無効にされたことが原因らしい。
接続元の /etc/ssh/ssh_config に
HostKeyAlgorithms ssh-dss,ssh-rsa
を追記
# 鍵交換方法の指定をする。
takaq@q4os-v200:~$ ssh delegate2 -oKexAlgorithms=diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1
Unable to negotiate with 192.168.1.9 port 22: no matching cipher found. Their offer: aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,aes192-cbc,aes256-cbc,rijndael-cbc@lysator.liu.se
接続元の /etc/ssh/ssh_config に
# 実際の通信を暗号化する暗号化アルゴリズムを指定
Ciphers aes128-cbc
を追記
# 鍵交換方法の指定をする。
# 鍵交換ができたっぽい
takaq@q4os-v200:~$ ssh delegate2 -oKexAlgorithms=diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1
The authenticity of host 'delegate2 (192.168.1.9)' can't be established.
DSA key fingerprint is SHA256:WXzNE4ZbRhRAlfUSb1keD2wf3PHg54OFKAdHwPp+XDc.
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added 'delegate2' (DSA) to the list of known hosts.
# パスワード聞いてきた
(takaq@delegate2) Password:
# ログインできたよーーー♪
Last login: Tue Sep 12 14:19:15 2023 from lenovo.takaq.jp
Copyright (c) 1980, 1983, 1986, 1988, 1990, 1991, 1993, 1994
The Regents of the University of California. All rights reserved.
FreeBSD 4.11-RELEASE (GENERIC) #0: Fri Jan 21 17:21:22 GMT 2005
Welcome to FreeBSD!
Before seeking technical support, please use the following resources:
o Security advisories and updated errata information for all releases are
at http://www.FreeBSD.org/releases/ - always consult the ERRATA section
for your release first as it's updated frequently.
o The Handbook and FAQ documents are at http://www.FreeBSD.org/ and,
along with the mailing lists, can be searched by going to
http://www.FreeBSD.org/search/. If the doc distribution has
been installed, they're also available formatted in /usr/share/doc.
If you still have a question or problem, please take the output of
`uname -a', along with any relevant error messages, and email it
as a question to the questions@FreeBSD.org mailing list. If you are
unfamiliar with FreeBSD's directory layout, please refer to the hier(7)
man page. If you are not familiar with man pages, type `man man'.
You may also use /stand/sysinstall to re-enter the installation and
configuration utility. Edit /etc/motd to change this login announcement.
# それでも、下の接続コマンドだとダメっす。
takaq@q4os-v200:~$ ssh takaq@delegate2
Unable to negotiate with 192.168.1.9 port 22: no matching key exchange method found. Their offer: diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1
でも、接続できたから良しとしよう。
# ・・・と思ったけど、もうちょっと頑張ってみた。
接続元の /etc/ssh/ssh_config に
KexAlgorithms +diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1
を追記
ssh takaq@delegate2 で接続できました。よかったーーー、苦労しました。♪
takaq@q4os-v200:~$ sudo ssh takaq@delegate2
The authenticity of host 'delegate2 (192.168.1.9)' can't be established.
DSA key fingerprint is SHA256:WXzNE4ZbRhRAlfUSb1keD2wf3PHg54OFKAdHwPp+XDc.
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added 'delegate2' (DSA) to the list of known hosts.
(takaq@delegate2) Password:
Last login: Thu Sep 14 18:50:38 2023 from q4os-v200.takaq
Copyright (c) 1980, 1983, 1986, 1988, 1990, 1991, 1993, 1994
The Regents of the University of California. All rights reserved.
FreeBSD 4.11-RELEASE (GENERIC) #0: Fri Jan 21 17:21:22 GMT 2005
Welcome to FreeBSD!
Before seeking technical support, please use the following resources:
o Security advisories and updated errata information for all releases are
at http://www.FreeBSD.org/releases/ - always consult the ERRATA section
for your release first as it's updated frequently.
o The Handbook and FAQ documents are at http://www.FreeBSD.org/ and,
along with the mailing lists, can be searched by going to
http://www.FreeBSD.org/search/. If the doc distribution has
been installed, they're also available formatted in /usr/share/doc.
If you still have a question or problem, please take the output of
`uname -a', along with any relevant error messages, and email it
as a question to the questions@FreeBSD.org mailing list. If you are
unfamiliar with FreeBSD's directory layout, please refer to the hier(7)
man page. If you are not familiar with man pages, type `man man'.
You may also use /stand/sysinstall to re-enter the installation and
configuration utility. Edit /etc/motd to change this login announcement.
$
結論
接続元の /etc/ssh/ssh_config に
KexAlgorithms +diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1
HostKeyAlgorithms ssh-dss,ssh-rsa
Ciphers aes128-cbc
を追記
※ちなみに、接続元ユーザの /etc/ssh/ssh_configに書く前に、接続元ユーザの .ssh/configを作成して以下のように書いてもダメでした。
Host 192.168.*.*
KexAlgorithms +diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1
HostKeyAlgorithms=+ssh-dss,ssh-rsa
Ciphers aes128-cbc
|
|
|
ツボック
2023/09/24/07:51:12
No.3008
takaq
[
takaq
[
