Hi all,

openSSH 6.7 has just entered Debian unstable and will be in Debian jessie soon. It will probably land in other distributions rather sooner than later.

As the openSSH developers have--by default--disabled several kex algorithm in the latest openSSH 6.7 release, X2Go Client on older systems (Debian wheezy, Ubuntu 14.04, etc.) will fail connecting to those machines.

""" (This probably is the error message X2Go Client shows on your screen...)

X2Go Client reports: kex error : did not find one of algos diffie-hellman-group1-sha1 in list [email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1 for kex algos

"""

The issue can be addressed in two ways...

OPTION 1:
---------
If you only have control of the client, you may get the issue resolved by backporting a libssh 0.6.3 version. Consult your distribution's build tools to make this happen.

I will checkout what we as X2Go upstream can provide for you in our package repositories without breaking other parts of your system (older applications using libssh << 0.6.0 are very likely to break with that newer libssh).


OPTION 2:
---------
If you have control of the server, then you may want to re-enable the mode-insecure, older, by-default-disabled algos. From the sshd_config man page in openSSH 6.7:

"""
     KexAlgorithms
             Specifies the available KEX (Key Exchange) algorithms.  Multiple
algorithms must be comma-separated. The supported algorithms are:

                   [email protected]
                   diffie-hellman-group1-sha1
                   diffie-hellman-group14-sha1
                   diffie-hellman-group-exchange-sha1
                   diffie-hellman-group-exchange-sha256
                   ecdh-sha2-nistp256
                   ecdh-sha2-nistp384
                   ecdh-sha2-nistp521

             The default is:

                   [email protected],
                   ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,
                   diffie-hellman-group-exchange-sha256,
                   diffie-hellman-group14-sha1
"""

What you probably have to add to the KexAlgorithms parameter in /etc/ssh/sshd_config are these additional algos: diffie-hellman-group1-sha1 and diffie-hellman-group-exchange-sha1.

"""
KexAlgorithms [email protected],diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521
"""

If you use the KexAlgorithms option in sshd_config, make sure that you:

  o also add all the default algos
  o restart openSSH server on your server and try a second login
    while you are still logged in with another session (in case you
    broker something by editing sshd_config)

Greets,
Mike

--
DAS-NETZWERKTEAM
mike gabriel, herweg 7, 24357 fleckeby
fon: +49 (1520) 1976 148

GnuPG Key ID 0x25771B31
mail: [email protected], http://das-netzwerkteam.de

freeBusy:
https://mail.das-netzwerkteam.de/freebusy/m.gabriel%40das-netzwerkteam.de.xfb

Attachment: pgp3nFcAJ5QRJ.pgp
Description: Digitale PGP-Signatur

_______________________________________________
x2go-user mailing list
[email protected]
http://lists.x2go.org/listinfo/x2go-user

Reply via email to