Re: [公告] PTT SSH RSA 金鑰更換

[asdfghjklasd (最討厭群組拉人不先問)]

解決方式

在 .ssh/config 加

Host *
  KexAlgorithms [e-mail]
就可以

ssh [e-mail]

ssh -vvv log 如下
OpenSSH_7.4p1, OpenSSL 1.0.2k-fips  26 Jan 2017
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 58: Applying options for *
debug2: resolving "bbs.ptt.cc" port 22
debug2: ssh_connect_direct: needpriv 0
debug1: Connecting to bbs.ptt.cc [140.112.172.11] port 22.
debug1: Connection established.
debug1: permanently_set_uid: 0/0
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_rsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_rsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_dsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_dsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_ecdsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_ecdsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_ed25519 type -1
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_ed25519-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_7.4
debug1: Remote protocol version 2.0, remote software version bbs-sshd
debug1: no match: bbs-sshd
debug2: fd 3 setting O_NONBLOCK
debug1: Authenticating to bbs.ptt.cc:22 as 'bbsu'
debug3: send packet: type 20
debug1: SSH2_MSG_KEXINIT sent
debug3: receive packet: type 20
debug1: SSH2_MSG_KEXINIT received
debug2: local client KEXINIT proposal
debug2: KEX algorithms: curve25519-sha256,[e-mail],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c
debug2: host key algorithms: [e-mail],[e-mail],[e-mail],[e-mail],[e-mail],[e-mail],ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss
debug2: ciphers ctos: [e-mail],aes128-ctr,aes192-ctr,aes256-ctr,[e-mail],[e-mail],aes128-cbc,aes192-cbc,aes256-cbc
debug2: ciphers stoc: [e-mail],aes128-ctr,aes192-ctr,aes256-ctr,[e-mail],[e-mail],aes128-cbc,aes192-cbc,aes256-cbc
debug2: MACs ctos: [e-mail],[e-mail],[e-mail],[e-mail],[e-mail],[e-mail],[e-mail],hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: MACs stoc: [e-mail],[e-mail],[e-mail],[e-mail],[e-mail],[e-mail],[e-mail],hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: compression ctos: none,[e-mail],zlib
debug2: compression stoc: none,[e-mail],zlib
debug2: languages ctos:
debug2: languages stoc:
debug2: first_kex_follows 0
debug2: reserved 0
debug2: peer server KEXINIT proposal
debug2: KEX algorithms: curve25519-sha256,[e-mail],diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,ext-info-s,[e-mail]
debug2: host key algorithms: ssh-ed25519,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa
debug2: ciphers ctos: [e-mail],[e-mail],aes256-ctr,aes192-ctr,aes128-ctr
debug2: ciphers stoc: [e-mail],[e-mail],aes256-ctr,aes192-ctr,aes128-ctr
debug2: MACs ctos: [e-mail],[e-mail],hmac-sha2-512,hmac-sha2-256,[e-mail],hmac-sha1
debug2: MACs stoc: [e-mail],[e-mail],hmac-sha2-512,hmac-sha2-256,[e-mail],hmac-sha1
debug2: compression ctos: none
debug2: compression stoc: none
debug2: languages ctos:
debug2: languages stoc:
debug2: first_kex_follows 0
debug2: reserved 0
debug1: kex: algorithm: curve25519-sha256
debug1: kex: host key algorithm: ecdsa-sha2-nistp256
debug1: kex: server->client cipher: [e-mail] MAC: <implicit> compression: none
debug1: kex: client->server cipher: [e-mail] MAC: <implicit> compression: none
debug1: kex: curve25519-sha256 need=64 dh_need=64
debug1: kex: curve25519-sha256 need=64 dh_need=64
debug3: send packet: type 30
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY

麻煩站方再看一下,要怎設定才能連.
※ 引述《wens (文思)》之銘言：
: 由於批踢踢 SSH 原先使用的 RSA 金鑰長度已不符現今最短長度要求，因此予以更換。
: 以下為新的 RSA 金鑰的指紋：
: 3072 SHA256:9/gkjxWjuteMj//K0sRo1gj7h5qTp0HPIH3n7+e3Jqc [e-mail] (RSA)
: +---[RSA 3072]----+
: |                 |
: |                 |
: |                 |
: |       ..        |
: |      . Soo=+    |
: |       o.*=*+o   |
: |        .=*B=    |
: |        o+BX=o oo|
: |        *Bo=BEO++|
: +----[SHA256]-----+
: 同時並將現行 SSH 金鑰指紋登載於 DNS SSHFP 紀錄。

--
※ 發信站: 批踢踢實業坊(ptt.cc), 來自: 158.101.145.243 (日本)
※ 文章網址: https://www.ptt.cc/bbs/SYSOP/M.1728452373.A.180.html
→ wens: 阿你的 SSH 還在 7.4?
→ wens: 看不出問題在哪，就看起來停住了
推 yvb: 我的版本更舊, 但用起來正常...
→ yvb: OpenSSH_7.2p2, OpenSSL 1.0.1 14 Mar 2012
→ asdfghjklasd: 我9.9p1 的也不行.
推 yvb: google: expecting SSH2_MSG_KEX_ECDH_REPLY
→ yvb: 試試看是否其中是有方式可以解決這問題.
→ asdfghjklasd: 我有google 過試過蠻多方式
→ asdfghjklasd: 現在用xshell 直連
推 a123453906: 我也是卡一樣地方
→ a123453906: ssh -o KexAlgorithms=curve25519-
→ a123453906: sha256 [e-mail]
→ a123453906: 後來加上這個就能連了
→ asdfghjklasd: 我加上也可以了.感謝分享
※ 編輯: asdfghjklasd (140.238.52.217 日本), 10/10/2024 21:52:04
推 yvb: 看來是 CentOS 才有這樣的問題.
→ asdfghjklasd: 我是 Oracle Linux and ubuntu
推 yvb: 噢, 沒用過 Oracle Linux, 或許它和 CentOS
→ yvb: 有一些共通的部分?
→ yvb: 至於 ubuntu 之前好像用人說沒問題...
→ yvb: 不知原PO的 ubuntu 是使用什麼版本發生問題?
→ asdfghjklasd: buntu 24.04.1 LTS  這個版本
→ jyhfang: Ubuntu 24.04.1 LTS 很常見的版本 真神奇
→ jyhfang: 有機會來試試