A NOTE has been added to this issue. ====================================================================== https://www.opencsw.org/mantis/view.php?id=5173 ====================================================================== Reported By: schwindt Assigned To: yann ====================================================================== Project: openssh Issue ID: 5173 Category: other Reproducibility: always Severity: major Priority: normal Status: feedback ====================================================================== Date Submitted: 2014-05-22 15:11 CEST Last Modified: 2014-06-11 11:40 CEST ====================================================================== Summary: Bug in sshd when using ed25519 keys Description: Remember me reporting ed25519 keys not being generated ? If only I had kept my mouth shut .)
The keys get generated but they can't be used. On setting up a fresh machine, which consequently did not have the rsa host key, I was not able to connect to a machine having an ed25519 hostkey. Removing the key from the server and knownhosts, modifying /opt/csw/sbin/sshd.smf_wrapper not to generate keys, restarting sshd -> everything changes back to normal. This happens for solaris clients as well as e.g. archlinux clients. ====================================================================== ---------------------------------------------------------------------- (0010860) schwindt (developer) - 2014-06-11 11:40 https://www.opencsw.org/mantis/view.php?id=5173#c10860 ---------------------------------------------------------------------- The server : schwindt@isg-1505 [/home/schwindt] /opt/csw/sbin/sshd -p 1025 -d -d -d debug2: load_server_config: filename /etc/opt/csw/ssh/sshd_config debug2: load_server_config: done config len = 289 debug2: parse_server_config: config /etc/opt/csw/ssh/sshd_config len 289 debug3: /etc/opt/csw/ssh/sshd_config:54 setting AuthorizedKeysFile .ssh/authorized_keys debug3: /etc/opt/csw/ssh/sshd_config:99 setting UsePAM yes debug3: /etc/opt/csw/ssh/sshd_config:104 setting X11Forwarding yes debug3: /etc/opt/csw/ssh/sshd_config:108 setting PrintMotd no debug3: /etc/opt/csw/ssh/sshd_config:112 setting UsePrivilegeSeparation sandbox debug3: /etc/opt/csw/ssh/sshd_config:128 setting Subsystem sftp /opt/csw/libexec/sftp-server debug1: sshd version OpenSSH_6.6, OpenSSL 1.0.1g 7 Apr 2014 debug3: Incorrect RSA1 identifier debug1: key_parse_private2: missing begin marker debug1: read PEM private key done: type RSA debug3: Incorrect RSA1 identifier debug3: Could not load "/etc/opt/csw/ssh/ssh_host_rsa_key" as a RSA1 public key debug1: private host key: https://www.opencsw.org/mantis/view.php?id=0 type 1 RSA debug3: Incorrect RSA1 identifier debug1: key_parse_private2: missing begin marker debug1: read PEM private key done: type DSA debug3: Incorrect RSA1 identifier debug3: Could not load "/etc/opt/csw/ssh/ssh_host_dsa_key" as a RSA1 public key debug1: private host key: https://www.opencsw.org/mantis/view.php?id=1 type 2 DSA debug3: Incorrect RSA1 identifier debug1: key_parse_private2: missing begin marker debug1: read PEM private key done: type RSA debug3: Incorrect RSA1 identifier debug3: Could not load "/etc/opt/csw/ssh/ssh_host_ecdsa_key" as a RSA1 public key debug1: private host key: https://www.opencsw.org/mantis/view.php?id=2 type 1 RSA debug3: Incorrect RSA1 identifier debug3: Incorrect RSA1 identifier debug3: Could not load "/etc/opt/csw/ssh/ssh_host_ed25519_key" as a RSA1 public key debug1: private host key: https://www.opencsw.org/mantis/view.php?id=3 type 4 ED25519 debug1: rexec_argv[0]='/opt/csw/sbin/sshd' debug1: rexec_argv[1]='-p' debug1: rexec_argv[2]='1025' debug1: rexec_argv[3]='-d' debug1: rexec_argv[4]='-d' debug1: rexec_argv[5]='-d' debug2: fd 4 setting O_NONBLOCK debug3: sock_set_v6only: set socket 4 IPV6_V6ONLY debug1: Bind to port 1025 on ::. Server listening on :: port 1025. debug2: fd 5 setting O_NONBLOCK debug1: Bind to port 1025 on 0.0.0.0. Server listening on 0.0.0.0 port 1025. debug1: fd 6 clearing O_NONBLOCK debug1: Server will not fork when running in debugging mode. debug3: send_rexec_state: entering fd = 11 config len 289 debug3: ssh_msg_send: type 0 debug3: send_rexec_state: done debug1: rexec start in 6 out 6 newsock 6 pipe -1 sock 11 debug1: inetd sockets after dupping: 4, 4 Connection from 192.168.15.105 port 50700 on 192.168.15.105 port 1025 debug1: Client protocol version 2.0; client software version OpenSSH_6.6 debug1: match: OpenSSH_6.6 pat OpenSSH* compat 0x04000000 debug1: Enabling compatibility mode for protocol 2.0 debug1: Local version string SSH-2.0-OpenSSH_6.6 debug2: fd 4 setting O_NONBLOCK debug2: Network child is on pid 28142 debug3: preauth child monitor started debug3: privsep user:group 60003:60003 [preauth] debug1: permanently_set_uid: 60003/60003 [preauth] debug1: list_hostkey_types: ssh-rsa,ssh-dss,ssh-rsa,ssh-ed25519 [preauth] debug1: SSH2_MSG_KEXINIT sent [preauth] debug1: SSH2_MSG_KEXINIT received [preauth] debug2: kex_parse_kexinit: [email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1 [preauth] debug2: kex_parse_kexinit: ssh-rsa,ssh-dss,ssh-rsa,ssh-ed25519 [preauth] debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,[email protected],[email protected],[email protected],aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,[email protected] [preauth] debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,[email protected],[email protected],[email protected],aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,[email protected] [preauth] debug2: kex_parse_kexinit: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-md5,hmac-sha1,[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,[email protected],hmac-sha1-96,hmac-md5-96 [preauth] debug2: kex_parse_kexinit: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-md5,hmac-sha1,[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,[email protected],hmac-sha1-96,hmac-md5-96 [preauth] debug2: kex_parse_kexinit: none,[email protected] [preauth] debug2: kex_parse_kexinit: none,[email protected] [preauth] debug2: kex_parse_kexinit: [preauth] debug2: kex_parse_kexinit: [preauth] debug2: kex_parse_kexinit: first_kex_follows 0 [preauth] debug2: kex_parse_kexinit: reserved 0 [preauth] debug2: kex_parse_kexinit: [email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1 [preauth] debug2: kex_parse_kexinit: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,ssh-rsa,ssh-dss [preauth] debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,[email protected],[email protected],[email protected],aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,[email protected] [preauth] debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,[email protected],[email protected],[email protected],aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,[email protected] [preauth] debug2: kex_parse_kexinit: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-md5,hmac-sha1,[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,[email protected],hmac-sha1-96,hmac-md5-96 [preauth] debug2: kex_parse_kexinit: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-md5,hmac-sha1,[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,[email protected],hmac-sha1-96,hmac-md5-96 [preauth] debug2: kex_parse_kexinit: none,[email protected],zlib [preauth] debug2: kex_parse_kexinit: none,[email protected],zlib [preauth] debug2: kex_parse_kexinit: [preauth] debug2: kex_parse_kexinit: [preauth] debug2: kex_parse_kexinit: first_kex_follows 0 [preauth] debug2: kex_parse_kexinit: reserved 0 [preauth] debug2: mac_setup: setup [email protected] [preauth] debug1: kex: client->server aes128-ctr [email protected] none [preauth] debug2: mac_setup: setup [email protected] [preauth] debug1: kex: server->client aes128-ctr [email protected] none [preauth] debug1: expecting SSH2_MSG_KEX_ECDH_INIT [preauth] debug3: mm_key_sign entering [preauth] debug3: mm_request_send entering: type 6 [preauth] debug3: mm_key_sign: waiting for MONITOR_ANS_SIGN [preauth] debug3: mm_request_receive_expect entering: type 7 [preauth] debug3: mm_request_receive entering [preauth] debug3: mm_request_receive entering debug3: monitor_read: checking request 6 debug3: mm_answer_sign debug3: mm_answer_sign: signature 812e1f8(83) debug3: mm_request_send entering: type 7 debug2: monitor_read: 6 used once, disabling now debug2: kex_derive_keys [preauth] debug2: set_newkeys: mode 1 [preauth] debug1: SSH2_MSG_NEWKEYS sent [preauth] debug1: expecting SSH2_MSG_NEWKEYS [preauth] Connection closed by 192.168.15.105 [preauth] debug1: do_cleanup [preauth] debug3: PAM: sshpam_thread_cleanup entering [preauth] debug3: mm_request_receive entering debug1: do_cleanup debug3: PAM: sshpam_thread_cleanup entering debug1: Killing privsep child 28142
