[gentoo-user] ssh problem

[gentoo-user] ssh problem

[dhk]

After a recent upgrade to ssh I can no longer log into my Gentoo box
(amd64) from another Gentoo box (x86) that has also had a recent upgrade
to ssh.  However, I can log in to it from Suse and Redhat boxes.

Any ideas?

Thanks

dhk

Re: [gentoo-user] ssh problem

[Alan McKinnon]

On Tuesday 22 February 2011 06:43:33 dhk wrote:
> After a recent upgrade to ssh I can no longer log into my Gentoo box
> (amd64) from another Gentoo box (x86) that has also had a recent upgrade
> to ssh.  However, I can log in to it from Suse and Redhat boxes.
> 
> Any ideas?

None whatsoever.

Supplying logs might change that though.


-- 
alan dot mckinnon at gmail dot com

Re: [gentoo-user] ssh problem

[dhk]

On 02/22/2011 07:37 AM, Alan McKinnon wrote:
> On Tuesday 22 February 2011 06:43:33 dhk wrote:
>> After a recent upgrade to ssh I can no longer log into my Gentoo box
>> (amd64) from another Gentoo box (x86) that has also had a recent upgrade
>> to ssh.  However, I can log in to it from Suse and Redhat boxes.
>>
>> Any ideas?
> 
> None whatsoever.
> 
> Supplying logs might change that though.
> 
> 

I don't see anything in the logs, but with the -v command I get the
following when trying to log in through the WAN.  Also port 22 is open
on the switch.


$ ssh -v -v -v user@12.12.12.123
OpenSSH_5.8p1-hpn13v10, OpenSSL 1.0.0d 8 Feb 2011
debug1: Reading configuration data /etc/ssh/ssh_config
debug2: ssh_connect: needpriv 0
debug1: Connecting to 12.12.12.123 [12.12.12.123] port 22.

Re: [gentoo-user] ssh problem

[Mick]

On 22 February 2011 13:24, dhk <dhkuhl@optonline.net> wrote:
> On 02/22/2011 07:37 AM, Alan McKinnon wrote:
>> On Tuesday 22 February 2011 06:43:33 dhk wrote:
>>> After a recent upgrade to ssh I can no longer log into my Gentoo box
>>> (amd64) from another Gentoo box (x86) that has also had a recent upgrade
>>> to ssh.  However, I can log in to it from Suse and Redhat boxes.
>>>
>>> Any ideas?
>>
>> None whatsoever.
>>
>> Supplying logs might change that though.
>>
>>
>
> I don't see anything in the logs, but with the -v command I get the
> following when trying to log in through the WAN.  Also port 22 is open
> on the switch.
>
>
> $ ssh -v -v -v user@12.12.12.123
> OpenSSH_5.8p1-hpn13v10, OpenSSL 1.0.0d 8 Feb 2011
> debug1: Reading configuration data /etc/ssh/ssh_config
> debug2: ssh_connect: needpriv 0
> debug1: Connecting to 12.12.12.123 [12.12.12.123] port 22.

There was a change in the default ssh encryption algorithm.  You may
want to check if that is causing the problem.
-- 
Regards,
Mick

Re: [gentoo-user] ssh problem

[dhkuhl]

[-- Attachment #1: Type: text/plain, Size: 1203 bytes --]

----- Original Message -----From: Mick Date: Tuesday, February 22, 2011 9:11 amSubject: Re: [gentoo-user] ssh problemTo: gentoo-user@lists.gentoo.org> On 22 February 2011 13:24, dhk  wrote:> > On 02/22/2011 07:37 AM, Alan McKinnon wrote:> >> On Tuesday 22 February 2011 06:43:33 dhk wrote:> >>> After a recent upgrade to ssh I can no longer log into my > Gentoo box> >>> (amd64) from another Gentoo box (x86) that has also had a > recent upgrade> >>> to ssh.  However, I can log in to it from Suse and Redhat boxes.> >>>> >>> Any ideas?> >>> >> None whatsoever.> >>> >> Supplying logs might change that though.> >>> >>> >> > I don't see anything in the logs, but with the -v command I > get the> > following when trying to log in through the WAN.  Also port 22 > is open> > on the switch.> >> >> > $ ssh -v -v -v user@12.12.12.123> > OpenSSH_5.8p1-hpn13v10, OpenSSL 1.0.0d 8 Feb 2011> > debug1: Reading configuration data /etc/ssh/ssh_config> > debug2: ssh_connect: needpriv 0> > debug1: Connecting to 12.12.12.123 [12.12.12.123] port 22.> > There was a change in the default ssh encryption algorithm.  You may> want to check if that is causing the problem.> -- > Regards,> Mick> >How would I do that?

[-- Attachment #2: Type: text/html, Size: 1780 bytes --]

Re: [gentoo-user] ssh problem

[Mick]

On 22 February 2011 14:19,  <dhkuhl@optonline.net> wrote:

> ----- Original Message -----
> From: Mick

>> There was a change in the default ssh encryption algorithm. You may
>> want to check if that is causing the problem.

> How would I do that?

By examining your config files?  Previously your keys would be in
~/.ssh/id_dsa[rsa].pub, but now with ECDSA being the default they
would be in ~/.ssh/id_ecdsa.pub

I recall something being mentioned in the elog asking to regenerate
the key-pair.

HTH.
-- 
Regards,
Mick

Re: [gentoo-user] ssh problem

[Joost Roeleveld]

On Tuesday 22 February 2011 14:51:31 Mick wrote:
> On 22 February 2011 14:19,  <dhkuhl@optonline.net> wrote:
> > ----- Original Message -----
> > From: Mick
> > 
> >> There was a change in the default ssh encryption algorithm. You may
> >> want to check if that is causing the problem.
> > 
> > How would I do that?
> 
> By examining your config files?  Previously your keys would be in
> ~/.ssh/id_dsa[rsa].pub, but now with ECDSA being the default they
> would be in ~/.ssh/id_ecdsa.pub
> 
> I recall something being mentioned in the elog asking to regenerate
> the key-pair.
> 
> HTH.

If this is the case, you could try speciying your key on the command-line 
using the "-i" flag:

# ssh -i .ssh/id_dsa.pub <host....>

Replace the file with the one on your machine.

HTH,

Joost

Re: [gentoo-user] ssh problem

[dhk]

On 02/23/2011 03:42 AM, Joost Roeleveld wrote:
> On Tuesday 22 February 2011 14:51:31 Mick wrote:
>> On 22 February 2011 14:19,  <dhkuhl@optonline.net> wrote:
>>> ----- Original Message -----
>>> From: Mick
>>>
>>>> There was a change in the default ssh encryption algorithm. You may
>>>> want to check if that is causing the problem.
>>>
>>> How would I do that?
>>
>> By examining your config files?  Previously your keys would be in
>> ~/.ssh/id_dsa[rsa].pub, but now with ECDSA being the default they
>> would be in ~/.ssh/id_ecdsa.pub
>>
>> I recall something being mentioned in the elog asking to regenerate
>> the key-pair.
>>
>> HTH.
> 
> If this is the case, you could try speciying your key on the command-line 
> using the "-i" flag:
> 
> # ssh -i .ssh/id_dsa.pub <host....>
> 
> Replace the file with the one on your machine.
> 
> HTH,
> 
> Joost
> 
> 

I still haven't gotten this to work.  Am I the only one using this?  The
"ssh -i .ssh/id_dsa.pub host" didn't work.  I get a message "Read from
socket failed: Connection reset by peer" with or without the -i option.

When I re-emerged openssh the following output is displayed.

# emerge openssh
Calculating dependencies... done!
>>> Verifying ebuild manifests
>>> Emerging (1 of 1) net-misc/openssh-5.8_p1-r1
>>> Installing (1 of 1) net-misc/openssh-5.8_p1-r1
>>> Jobs: 1 of 1 complete                           Load avg: 2.80,
1.95, 1.43

 * Messages for package net-misc/openssh-5.8_p1-r1:

 * Starting with openssh-5.8p1, the server will default to a newer key
 * algorithm (ECDSA).  You are encouraged to manually update your stored
 * keys list as servers update theirs.  See ssh-keyscan(1) for more info.
 * Remember to merge your config files in /etc/ssh/ and then
 * reload sshd: '/etc/init.d/sshd reload'.
 * Please be aware users need a valid shell in /etc/passwd
 * in order to be allowed to login.
>>> Auto-cleaning packages...

>>> No outdated packages were found on your system.

 * GNU info directory index is up-to-date.

The ssh-keyscan man page hasn't helped.

As of now I can only log in from older systems.

dhk

Re: [gentoo-user] ssh problem

[Mick]

On 24 February 2011 13:17, dhk <dhkuhl@optonline.net> wrote:
> On 02/23/2011 03:42 AM, Joost Roeleveld wrote:
>> On Tuesday 22 February 2011 14:51:31 Mick wrote:
>>> On 22 February 2011 14:19,  <dhkuhl@optonline.net> wrote:
>>>> ----- Original Message -----
>>>> From: Mick
>>>>
>>>>> There was a change in the default ssh encryption algorithm. You may
>>>>> want to check if that is causing the problem.
>>>>
>>>> How would I do that?
>>>
>>> By examining your config files?  Previously your keys would be in
>>> ~/.ssh/id_dsa[rsa].pub, but now with ECDSA being the default they
>>> would be in ~/.ssh/id_ecdsa.pub
>>>
>>> I recall something being mentioned in the elog asking to regenerate
>>> the key-pair.
>>>
>>> HTH.
>>
>> If this is the case, you could try speciying your key on the command-line
>> using the "-i" flag:
>>
>> # ssh -i .ssh/id_dsa.pub <host....>
>>
>> Replace the file with the one on your machine.
>>
>> HTH,
>>
>> Joost
>>
>>
>
> I still haven't gotten this to work.  Am I the only one using this?  The
> "ssh -i .ssh/id_dsa.pub host" didn't work.  I get a message "Read from
> socket failed: Connection reset by peer" with or without the -i option.
>
> When I re-emerged openssh the following output is displayed.
>
> # emerge openssh
> Calculating dependencies... done!
>>>> Verifying ebuild manifests
>>>> Emerging (1 of 1) net-misc/openssh-5.8_p1-r1
>>>> Installing (1 of 1) net-misc/openssh-5.8_p1-r1
>>>> Jobs: 1 of 1 complete                           Load avg: 2.80,
> 1.95, 1.43
>
>  * Messages for package net-misc/openssh-5.8_p1-r1:
>
>  * Starting with openssh-5.8p1, the server will default to a newer key
>  * algorithm (ECDSA).  You are encouraged to manually update your stored
>  * keys list as servers update theirs.  See ssh-keyscan(1) for more info.
>  * Remember to merge your config files in /etc/ssh/ and then
>  * reload sshd: '/etc/init.d/sshd reload'.
>  * Please be aware users need a valid shell in /etc/passwd
>  * in order to be allowed to login.
>>>> Auto-cleaning packages...
>
>>>> No outdated packages were found on your system.
>
>  * GNU info directory index is up-to-date.
>
> The ssh-keyscan man page hasn't helped.
>
> As of now I can only log in from older systems.

This would imply that your older (rsa/dsa) server keys still work.

What have you changed on your Gentoo client?

Have you tried using ssh user@host to login with?
-- 
Regards,
Mick

Re: [gentoo-user] ssh problem

[dhk]

On 02/24/2011 08:53 AM, Mick wrote:
> On 24 February 2011 13:17, dhk <dhkuhl@optonline.net> wrote:
>> On 02/23/2011 03:42 AM, Joost Roeleveld wrote:
>>> On Tuesday 22 February 2011 14:51:31 Mick wrote:
>>>> On 22 February 2011 14:19,  <dhkuhl@optonline.net> wrote:
>>>>> ----- Original Message -----
>>>>> From: Mick
>>>>>
>>>>>> There was a change in the default ssh encryption algorithm. You may
>>>>>> want to check if that is causing the problem.
>>>>>
>>>>> How would I do that?
>>>>
>>>> By examining your config files?  Previously your keys would be in
>>>> ~/.ssh/id_dsa[rsa].pub, but now with ECDSA being the default they
>>>> would be in ~/.ssh/id_ecdsa.pub
>>>>
>>>> I recall something being mentioned in the elog asking to regenerate
>>>> the key-pair.
>>>>
>>>> HTH.
>>>
>>> If this is the case, you could try speciying your key on the command-line
>>> using the "-i" flag:
>>>
>>> # ssh -i .ssh/id_dsa.pub <host....>
>>>
>>> Replace the file with the one on your machine.
>>>
>>> HTH,
>>>
>>> Joost
>>>
>>>
>>
>> I still haven't gotten this to work.  Am I the only one using this?  The
>> "ssh -i .ssh/id_dsa.pub host" didn't work.  I get a message "Read from
>> socket failed: Connection reset by peer" with or without the -i option.
>>
>> When I re-emerged openssh the following output is displayed.
>>
>> # emerge openssh
>> Calculating dependencies... done!
>>>>> Verifying ebuild manifests
>>>>> Emerging (1 of 1) net-misc/openssh-5.8_p1-r1
>>>>> Installing (1 of 1) net-misc/openssh-5.8_p1-r1
>>>>> Jobs: 1 of 1 complete                           Load avg: 2.80,
>> 1.95, 1.43
>>
>>  * Messages for package net-misc/openssh-5.8_p1-r1:
>>
>>  * Starting with openssh-5.8p1, the server will default to a newer key
>>  * algorithm (ECDSA).  You are encouraged to manually update your stored
>>  * keys list as servers update theirs.  See ssh-keyscan(1) for more info.
>>  * Remember to merge your config files in /etc/ssh/ and then
>>  * reload sshd: '/etc/init.d/sshd reload'.
>>  * Please be aware users need a valid shell in /etc/passwd
>>  * in order to be allowed to login.
>>>>> Auto-cleaning packages...
>>
>>>>> No outdated packages were found on your system.
>>
>>  * GNU info directory index is up-to-date.
>>
>> The ssh-keyscan man page hasn't helped.
>>
>> As of now I can only log in from older systems.
> 
> This would imply that your older (rsa/dsa) server keys still work.
> 
> What have you changed on your Gentoo client?
> 
> Have you tried using ssh user@host to login with?

At first all I did was an update:  emerge -uDN world .  They when it
didn't work I removed all public and private keys and restarted sshd.
That didn't work then I tried the ssh-keygen and ssh-keyscan.  That
didn't work so I removed all keys again and restarted sshd.  Are there
ssh_config or sshd_config options that should be set?

Thanks,

dhk

Re: [gentoo-user] ssh problem

[dhk]

On 02/24/2011 03:01 PM, Matthew Marlowe wrote:
> On Thursday, February 24, 2011 10:09:22 am dhk wrote:
>>>>
>>>> I still haven't gotten this to work.  Am I the only one using this?  The
>>>> "ssh -i .ssh/id_dsa.pub host" didn't work.  I get a message "Read from
>>>> socket failed: Connection reset by peer" with or without the -i option.
>>>>
> 
> I encountered a similar, if not the same, problem this morning.
> Upgraded SSH, rebooted server, and no longer able to login.  Logs showed 
> errors I had not seen before.
> 
> I managed to solve the problem when I noticed that ssh'ing to the fqdn of the 
> server failed, but ssh'ing to the server hostname worked.  This implied there 
> might be an issue with the known_hosts file, so I blew away that on both the 
> client and server and all was well.
> 
> I'm guessing the upgrade modified the default ssh host keys, the new code 
> somehow doesn't give the normal error about discrepencies in known_hosts, and 
> consequently although ones user keys are still fine, it fails.  The issue here 
> is really the new error isn't nearly as understandable as the old.
> 
> Anyhow, try it and I hope it works.
> 
> Matt

Thanks, but I've tried that.  ssh'ing to the hostname and loopback
address work.  However, when I go out to the WAN it doesn't.  So I can't
ssh user@123.123.123.123 even though I have port 22 open on the switch
for my ip.

Re: [gentoo-user] ssh problem

[Mick]

[-- Attachment #1: Type: Text/Plain, Size: 487 bytes --]

On Thursday 24 February 2011 21:51:56 dhk wrote:

> Thanks, but I've tried that.  ssh'ing to the hostname and loopback
> address work.  However, when I go out to the WAN it doesn't.  So I can't
> ssh user@123.123.123.123 even though I have port 22 open on the switch
> for my ip.

Just to state the obvious, have your tried something like:

$ nc -v -z 123.123.123.123 22
123.123.123.123 (ssh) open

from a WAN client to make sure that the port is open?
-- 
Regards,
Mick

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 198 bytes --]

Re: [gentoo-user] ssh problem

[dhk]

On 02/24/2011 06:30 PM, Mick wrote:
> On Thursday 24 February 2011 21:51:56 dhk wrote:
> 
>> Thanks, but I've tried that.  ssh'ing to the hostname and loopback
>> address work.  However, when I go out to the WAN it doesn't.  So I can't
>> ssh user@123.123.123.123 even though I have port 22 open on the switch
>> for my ip.
> 
> Just to state the obvious, have your tried something like:
> 
> $ nc -v -z 123.123.123.123 22
> 123.123.123.123 (ssh) open
> 
> from a WAN client to make sure that the port is open?

I don't have the nc comand.  What package is it in?

Re: [gentoo-user] ssh problem

[Stroller]

On 25/2/2011, at 1:08am, dhk wrote:
> 
> I don't have the nc comand.  What package is it in?

net-analyzer/netcat

Re: [gentoo-user] ssh problem

[dhk]

On 02/24/2011 08:08 PM, dhk wrote:
> On 02/24/2011 06:30 PM, Mick wrote:
>> On Thursday 24 February 2011 21:51:56 dhk wrote:
>>
>>> Thanks, but I've tried that.  ssh'ing to the hostname and loopback
>>> address work.  However, when I go out to the WAN it doesn't.  So I can't
>>> ssh user@123.123.123.123 even though I have port 22 open on the switch
>>> for my ip.
>>
>> Just to state the obvious, have your tried something like:
>>
>> $ nc -v -z 123.123.123.123 22
>> 123.123.123.123 (ssh) open
>>
>> from a WAN client to make sure that the port is open?
> 
> I don't have the nc comand.  What package is it in?
> 
> 

The nc command does nothing when run from the same host I'm trying to
ssh in to.  I'm not sure what that means other than it can't make a
connection.  With the -w option I get:

# nc -w 3 -v -z 123.123.123.123 22
ool-43505ef2.dyn.optonline.net [123.123.123.123] 22 (ssh) : Connection
timed out

Re: [gentoo-user] ssh problem

[Mick]

[-- Attachment #1: Type: Text/Plain, Size: 1591 bytes --]

On Friday 25 February 2011 12:09:38 dhk wrote:
> On 02/24/2011 08:08 PM, dhk wrote:
> > On 02/24/2011 06:30 PM, Mick wrote:
> >> On Thursday 24 February 2011 21:51:56 dhk wrote:
> >>> Thanks, but I've tried that.  ssh'ing to the hostname and loopback
> >>> address work.  However, when I go out to the WAN it doesn't.  So I
> >>> can't ssh user@123.123.123.123 even though I have port 22 open on the
> >>> switch for my ip.
> >> 
> >> Just to state the obvious, have your tried something like:
> >> 
> >> $ nc -v -z 123.123.123.123 22
> >> 123.123.123.123 (ssh) open
> >> 
> >> from a WAN client to make sure that the port is open?
> > 
> > I don't have the nc comand.  What package is it in?
> 
> The nc command does nothing when run from the same host I'm trying to
> ssh in to.  I'm not sure what that means other than it can't make a
> connection.  With the -w option I get:
> 
> # nc -w 3 -v -z 123.123.123.123 22
> ool-43505ef2.dyn.optonline.net [123.123.123.123] 22 (ssh) : Connection
> timed out

OK, this proves that you have a connectivity problem.  If the port was open 
and there was a ssh server listening on port 22 for connections you would get 
an "open" response.

BTW, nc is not necessary, you could use e.g. telnet to check the connection:

$ telnet 123.123.123.123 22
SSH-2.0-OpenSSH_5.8p1-hpn13v10lpk

If instead of the above you are getting no response and you are confident that 
you have not defined something other than port 22 for connections to your ssh 
server, then there is perhaps a firewall problem?
-- 
Regards,
Mick

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 198 bytes --]

Re: [gentoo-user] ssh problem

[Adam Carter]

[-- Attachment #1: Type: text/plain, Size: 584 bytes --]

> The nc command does nothing when run from the same host I'm trying to
> ssh in to.
>

Ok so you may not have an ssh problem (so ignore the ssh specific stuff for
now) you have a network problem. It will be either routing or firewalling.
If you can ping the box, then its a firewall problem. So, try pinging it
first, and if that works then you know that routing is in place and its a
firewall problem. If that doesn't work try traceroute to see how far you can
get, and the last hop may provide clues as to why you can access it by
sending an ICMP message. Post back what you find.

[-- Attachment #2: Type: text/html, Size: 820 bytes --]

Re: [gentoo-user] ssh problem

[Mick]

[-- Attachment #1: Type: Text/Plain, Size: 868 bytes --]

On Saturday 26 February 2011 07:49:44 Adam Carter wrote:
> > The nc command does nothing when run from the same host I'm trying to
> > ssh in to.
> 
> Ok so you may not have an ssh problem (so ignore the ssh specific stuff for
> now) you have a network problem. It will be either routing or firewalling.
> If you can ping the box, then its a firewall problem. So, try pinging it
> first, and if that works then you know that routing is in place and its a
> firewall problem. If that doesn't work try traceroute to see how far you
> can get, and the last hop may provide clues as to why you can access it by
> sending an ICMP message. Post back what you find.

Depending on configuration of routers and firewalls ICMP packets may be 
dropped, so if plain ping/traceroute fails use httping and tcptraceroute (or 
traceroute -T -p 22)
-- 
Regards,
Mick

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 198 bytes --]

Re: [gentoo-user] ssh problem

[dhk]

On 02/26/2011 03:13 AM, Mick wrote:
> On Saturday 26 February 2011 07:49:44 Adam Carter wrote:
>>> The nc command does nothing when run from the same host I'm trying to
>>> ssh in to.
>>
>> Ok so you may not have an ssh problem (so ignore the ssh specific stuff for
>> now) you have a network problem. It will be either routing or firewalling.
>> If you can ping the box, then its a firewall problem. So, try pinging it
>> first, and if that works then you know that routing is in place and its a
>> firewall problem. If that doesn't work try traceroute to see how far you
>> can get, and the last hop may provide clues as to why you can access it by
>> sending an ICMP message. Post back what you find.
> 
> Depending on configuration of routers and firewalls ICMP packets may be 
> dropped, so if plain ping/traceroute fails use httping and tcptraceroute (or 
> traceroute -T -p 22)

I don't know why I would have a firewall or network problem, the set up
I have has been here for 8+ years.  The setup is like this.  In the
basement the cable internet comes in and into a cable modem. Then an
RJ45 out of the cable modem into an 8-port NETGEAR Router/Switch.
Upstairs is a hub with three computers connected and this hub is
connected to the switch in the basement.  The only problem I ever had
was when the dhcp address changed, then it needed to be added to the
PORT FORWARDING section of the switch with port 22.

Remember I can still log in remotely from Redhat and Suse boxes that
weren't updated with the new openssh.

When ssh'ing in from a remote updated Gentoo box the "Read from socket
failed: Connection reset by peer" message is displayed.  This message is
not displayed when trying to ssh in from inside the network.

Alright, back to the task at hand.  When I tell the switch to "Respond
to Ping on Internet WAN Port" the ping statistics are good:  3 packets
transmitted, 3 received, 0% packet loss, time 2007ms.

I'm not sure where to go from here.

Is there anything in the sshd_config or ssh_config files that I need?
After the upgrade the new files were merged with the current.

Thanks
dhk

Re: [gentoo-user] ssh problem

[Adam Carter]

[-- Attachment #1: Type: text/plain, Size: 409 bytes --]

> When ssh'ing in from a remote updated Gentoo box the "Read from socket
> failed: Connection reset by peer" message is displayed.  This message is
> not displayed when trying to ssh in from inside the network.
>

Ok that's different (and not consistent with the Connection timed out
message, but lets ignore that for now)... try the HPN stuff i posted
earlier, or even better restart sshd on the remote box.

[-- Attachment #2: Type: text/html, Size: 619 bytes --]

Re: [gentoo-user] ssh problem

[Mick]

[-- Attachment #1: Type: Text/Plain, Size: 1409 bytes --]

On Thursday 24 February 2011 18:09:22 dhk wrote:
> On 02/24/2011 08:53 AM, Mick wrote:

> > Have you tried using ssh user@host to login with?
> 
> At first all I did was an update:  emerge -uDN world .  They when it
> didn't work I removed all public and private keys and restarted sshd.
> That didn't work then I tried the ssh-keygen and ssh-keyscan.  That
> didn't work so I removed all keys again and restarted sshd.  Are there
> ssh_config or sshd_config options that should be set?

I recommend you have another look at:

 http://www.gentoo.org/doc/en/articles/openssh-key-management-p1.xml

and from there Part 2 and Part 3 just in case you are missing something basic.

The only difference being that the latest openssh version is now using ECDSA 
as the default.

Therefore you should specify it as the prefered option in your server's and 
client's config files (which from the elog I am led to believe that it is the 
new default setting).

Also, note the elog comment about users needing a valid shell in /etc/passwd.  
Does your user have /bin/bash (or other shell of choice) at the end of the 
line in /etc/passwd?

PS.  I am able to login into a gentoo box which is running 5.8_p1-r1 using my 
ssh_host_rsa_key from a client also running 5.8_p1-r1.  So it seems that old 
keys should work fine - unless you have removed them from your server.
-- 
Regards,
Mick

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 198 bytes --]

Re: [gentoo-user] ssh problem

[Adam Carter]

[-- Attachment #1: Type: text/plain, Size: 272 bytes --]

Did you remember to restart the sshd on your amd64 system? If not, try
disabling the new high performance stuff on the client. I had a problem
logging into a solaris box until i disabled it. In my ~/.ssh/config file I
added;

host <ip or hostname>
        HPNDisabled yes

[-- Attachment #2: Type: text/html, Size: 298 bytes --]

Re: [gentoo-user] ssh problem

[dhk]

On 02/25/2011 05:36 AM, Adam Carter wrote:
> Did you remember to restart the sshd on your amd64 system? If not, try
> disabling the new high performance stuff on the client. I had a problem
> logging into a solaris box until i disabled it. In my ~/.ssh/config file I
> added;
> 
> host <ip or hostname>
>         HPNDisabled yes
> 


I don't have a ~/.ssh/config.  Will it default to ssh_config in /etc/ssh
or do I need to create one?

Re: [gentoo-user] ssh problem

[Alex Schuster]

dhk writes:

> On 02/25/2011 05:36 AM, Adam Carter wrote:
> > Did you remember to restart the sshd on your amd64 system? If not, try
> > disabling the new high performance stuff on the client. I had a problem
> > logging into a solaris box until i disabled it. In my ~/.ssh/config
> > file I added;
> > 
> > host <ip or hostname>
> > 
> >         HPNDisabled yes
> 
> I don't have a ~/.ssh/config.  Will it default to ssh_config in /etc/ssh
> or do I need to create one?

~/.ssh/config overrides settings in /etc/ssh/ssh_config.

BTW, ~/.ssh/config is very convenient so simplify access to hosts you acess 
frequently.
Example: With this entry, a 'ssh -p 12345 itsme@foo.long.domain.org' can be 
done simply as 'ssh foo'.

Host foo bar
	HostName foo.long.domain.org
	Port 12345
	User itsme

	Wonko

Re: [gentoo-user] ssh problem

[Mark Shields]

[-- Attachment #1: Type: text/plain, Size: 688 bytes --]

On Tue, Feb 22, 2011 at 6:43 AM, dhk <dhkuhl@optonline.net> wrote:

> After a recent upgrade to ssh I can no longer log into my Gentoo box
> (amd64) from another Gentoo box (x86) that has also had a recent upgrade
> to ssh.  However, I can log in to it from Suse and Redhat boxes.
>
> Any ideas?
>
> Thanks
>
> dhk
>
>
While this may not help you now, one of the things Gentoo devs recommend,
after updating the ssh daemon and restarting it, is to immediately try to
ssh back in and make sure you still can.  Do not close your original ssh
connection when you do this.

I've had these instructions save me a few times; since I was still
connected, I was able to fix the sshd_config file.

[-- Attachment #2: Type: text/html, Size: 1027 bytes --]

[gentoo-user] Ssh problem

[Philip Webb]

I updated Ssh yesterday :

  net-misc/openssh
  Available versions:  7.5_p1-r4 7.7_p1-r9^t 7.9_p1-r4^t {X X509 audit bindist debug (+)hpn kerberos ldap ldns libedit libressl livecd pam +pie sctp selinux skey ssh1 +ssl static test ABI_MIPS="n32" KERNEL="linux"}
  Installed versions:  7.9_p1-r4^t([2019-03-09 22:25:11])(X ssl -X509 -audit -bindist -debug -hpn -kerberos -ldns -libedit -libressl -livecd -pam -pie -sctp -selinux -static -test ABI_MIPS="-n32" KERNEL="linux")

Previously, I was using :  net-misc/openssh-7.7_p1-r9 .

Today, I tried to access an off-site via Ssh ,
which I've been doing for years & got this :

  ssh x.y.z
  Unable to negotiate with 128.100.160.1 port 22: no matching key exchange method found. Their offer: diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1

'x.y.z' disguises the site's URL, which doesn't seem to be a problem.

Can anyone suggest what's gone wrong ?

-- 
========================,,============================================
SUPPORT     ___________//___,   Philip Webb
ELECTRIC   /] [] [] [] [] []|   Cities Centre, University of Toronto
TRANSIT    `-O----------O---'   purslowatchassdotutorontodotca

Re: [gentoo-user] Ssh problem

[Nils Freydank]

[-- Attachment #1: Type: text/plain, Size: 1300 bytes --]

Hi Philip,

Am Sonntag, 10. März 2019, 08:25:54 CET schrieb Philip Webb:
> I updated Ssh yesterday :
> [...]
>   ssh x.y.z
>   Unable to negotiate with 128.100.160.1 port 22: no matching key
> exchange method found. Their offer:
> diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1
ssh tells you straight forward what the issue is: Within the key exchange
at the begin of the communication there was no way to establish a 
connection between the server and the client, probably because the client 
has a more secure setup than the server. This happens mostly due to old ssh 
versions serverside.

You can find solutions pretty fast by just searching for "Their offer: <key 
exchange offers>", e.g. https://unix.stackexchange.com/questions/340844/
how-to-enable-diffie-hellman-group1-sha1-key-exchange-on-debian-8-0

(Please enable legacy and possible less secure key exchange formats and 
ciphers only per server and not globally - and if possible upgrade the SSH 
server version.)

> 'x.y.z' disguises the site's URL, which doesn't seem to be a problem.
That is indeed perfectly fine; you might want to hide the IP address in the 
future aswell ;-)


Greetings,
Nils

-- 
GPG fingerprint: '00EF D31F 1B60 D5DB ADB8 31C1 C0EC E696 0E54 475B'
Nils Freydank

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 963 bytes --]

[gentoo-user] ssh problem

[Philip Webb]

I want to login to a remote site <aaaaa.bbbbbbbb.cc> using 'ssh'.
The response I get is "Unable to negotiate with <nnn.nnn.nnn.n> port <nn>:
no matching host key type found. Their offer: ssh-rsa,ssh-dss".
Yesterday, I updated 'openssh' :

  Installed versions:  8.8_p1-r4^t([2021-12-25 06:12:24])
   (X ssl -X509 -audit -debug -hpn -kerberos -ldns -libedit -livecd -pam -pie -scp -sctp -security-key -selinux -static -test -xmss ABI_MIPS="-n32" KERNEL="linux")

Occasionally, I have had a similar problem trying to do this,
but ordinarily it has worked smoothly.

Does anyone have helpful suggestions how to get past the blockage ?

-- 
========================,,============================================
SUPPORT     ___________//___,   Philip Webb
ELECTRIC   /] [] [] [] [] []|   Cities Centre, University of Toronto
TRANSIT    `-O----------O---'   purslowatchassdotutorontodotca

Re: [gentoo-user] ssh problem

[Branko Grubić]

On Sun, 2021-12-26 at 11:42 -0500, Philip Webb wrote:
> I want to login to a remote site <aaaaa.bbbbbbbb.cc> using 'ssh'.
> The response I get is "Unable to negotiate with <nnn.nnn.nnn.n> port
> <nn>:
> no matching host key type found. Their offer: ssh-rsa,ssh-dss".
> Yesterday, I updated 'openssh' :
> 
>   Installed versions:  8.8_p1-r4^t([2021-12-25 06:12:24])
>    (X ssl -X509 -audit -debug -hpn -kerberos -ldns -libedit -livecd -
> pam -pie -scp -sctp -security-key -selinux -static -test -xmss
> ABI_MIPS="-n32" KERNEL="linux")
> 
> Occasionally, I have had a similar problem trying to do this,
> but ordinarily it has worked smoothly.
> 
> Does anyone have helpful suggestions how to get past the blockage ?
> 
Hi,

Have you looked at news 2021-10-08-openssh-rsa-sha1[1]


Could be related.

Regards,
Branko

[1]
https://gitweb.gentoo.org/data/gentoo-news.git/commit/?id=8dea6aa24c3ec9ee9a391fb602733c1a803a1ad1

Re: [gentoo-user] ssh problem

[Neil Bothwick]

[-- Attachment #1: Type: text/plain, Size: 687 bytes --]

On Sun, 26 Dec 2021 11:42:41 -0500, Philip Webb wrote:

> I want to login to a remote site <aaaaa.bbbbbbbb.cc> using 'ssh'.
> The response I get is "Unable to negotiate with <nnn.nnn.nnn.n> port
> <nn>: no matching host key type found. Their offer: ssh-rsa,ssh-dss".
> Yesterday, I updated 'openssh' :

It sounds like the host may be running an old version of sshd that only
offers ciphers that are now disabled by default in newer releases. You
can get round this by enabling those ciphers for this host, with
something like this in ssh_config

Host aaaaa.bbbbbbbb.cc
    Ciphers +ssh-rsa


-- 
Neil Bothwick

Last words of a Windows user: = Why does that work now?

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: [gentoo-user] ssh problem

[Michael]

[-- Attachment #1: Type: text/plain, Size: 862 bytes --]

On Sunday, 26 December 2021 17:00:46 GMT Neil Bothwick wrote:
> On Sun, 26 Dec 2021 11:42:41 -0500, Philip Webb wrote:
> > I want to login to a remote site <aaaaa.bbbbbbbb.cc> using 'ssh'.
> > The response I get is "Unable to negotiate with <nnn.nnn.nnn.n> port
> > <nn>: no matching host key type found. Their offer: ssh-rsa,ssh-dss".
> 
> > Yesterday, I updated 'openssh' :
> It sounds like the host may be running an old version of sshd that only
> offers ciphers that are now disabled by default in newer releases. You
> can get round this by enabling those ciphers for this host, with
> something like this in ssh_config
> 
> Host aaaaa.bbbbbbbb.cc
>     Ciphers +ssh-rsa

The initial error is about "no matching host key type", so the option needed 
would be:

HostKeyAlgorithms +ssh-rsa

After which another error may pop up, probably about Ciphers.  ;-)

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: [gentoo-user] ssh problem

[Neil Bothwick]

[-- Attachment #1: Type: text/plain, Size: 412 bytes --]

On Sun, 26 Dec 2021 18:07:56 +0000, Michael wrote:

> > Host aaaaa.bbbbbbbb.cc
> >     Ciphers +ssh-rsa  
> 
> The initial error is about "no matching host key type", so the option
> needed would be:
> 
> HostKeyAlgorithms +ssh-rsa

You're right, I was looking at the wrong file when I looked for how I
dealt with this a while ago.


-- 
Neil Bothwick

Top Oxymorons Number 21: "Now, then ..."

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: [gentoo-user] ssh problem

[Philip Webb]

211226 Michael wrote:
> On Sun, 26 Dec 2021 11:42:41 -0500, Philip Webb wrote:
>> I want to login to a remote site <aaaaa.bbbbbbbb.cc> using 'ssh'.
>> The response I get is "Unable to negotiate with <nnn.nnn.nnn.n> port
>> <nn>: no matching host key type found. Their offer: ssh-rsa,ssh-dss".
>> Yesterday, I updated 'openssh' :
> It sounds like the host may be running an old version of sshd
> that only offers ciphers that are now disabled by default in newer releases.
> You can get round this by enabling those ciphers for this host,
> with something like this in ssh_config : 'HostKeyAlgorithms +ssh-rsa'.

Thanks to all the respondents : adding that line makes it work again.
I've made a note of the Ssh help site & updated by own nn too.

-- 
========================,,============================================
SUPPORT     ___________//___,   Philip Webb
ELECTRIC   /] [] [] [] [] []|   Cities Centre, University of Toronto
TRANSIT    `-O----------O---'   purslowatchassdotutorontodotca

Re: [gentoo-user] ssh problem

[Grant Taylor]

On 12/26/21 9:42 AM, Philip Webb wrote:
> I want to login to a remote site <aaaaa.bbbbbbbb.cc> using 'ssh'.
> The response I get is "Unable to negotiate with <nnn.nnn.nnn.n> port <nn>:
> no matching host key type found. Their offer: ssh-rsa,ssh-dss".
> Yesterday, I updated 'openssh' :

Michael's pointing in the proper direction.

Check out the OpenSSH Legacy Options page for more details.  I've 
successfully used this information to log into Red Hat 5.x from the 
'90s.  (Not contemporary RHEL.)

Link - OpenSSH: Legacy Options
  - https://www.openssh.com/legacy.html

Note:  This works exceedingly well in the ssh client config file 
(~/.ssh/config or /etc/ssh/ssh_config).  Using the config file means 
that anything that uses OpenSSH commands benefits from and inherits the 
configuration parameters; rsync, git, what have you.



-- 
Grant. . . .
unix || die