Re: [gentoo-user] openssh-7.1_p1-r2 won't allow "nxserver" to connect

[thelma@sys-concept.com]

Thelma

On 11/13/2015 11:08 PM, thelma@sys-concept.com wrote:
> I'm running: nxserver-freenx-0.7.3_p104-r7
> After recent upgrade, system installed new stable openssh-7.1_p1-r2
> 
> The problem is the new openssh-7.1_p1-r2 will not allow my my "nxserver" to connect, I get an error:
> Permission denied (publickey,keyboard-interactive) see below:
>  
> nxsetup --test
> ...
> <---- done
> 
> ----> Testing your nxserver connection ...
> Permission denied (publickey,keyboard-interactive).
> Fatal error: Could not connect to NX Server.
> 
> Please check your ssh setup:
> 
> The following are _examples_ of what you might need to check.
> 
> 	- Make sure "nx" is one of the AllowUsers in sshd_config.
>     (or that the line is outcommented/not there)
> 	- Make sure "nx" is one of the AllowGroups in sshd_config.
>     (or that the line is outcommented/not there)
> 	- Make sure your sshd allows public key authentication.
> 	- Make sure your sshd is really running on port 22.
> 	- Make sure your sshd_config AuthorizedKeysFile in sshd_config is set to authorized_keys2.
>     (this should be a filename not a pathname+filename)
>   - Make sure you allow ssh on localhost, this could come from some
>     restriction of:
>       -the tcp wrapper. Then add in /etc/hosts.allow: ALL:localhost
>       -the iptables. add to it:
>          $ iptables -A INPUT  -i lo -j ACCEPT
>          $ iptables -A OUTPUT -o lo -j ACCEPT
> 
> What I should be getting is this:
> ----> Testing your nxserver connection ...
> HELLO NXSERVER - Version 3.2.0-74-TEAMBZR104 OS (GPL, using backend: 3.5.0)
> NX> 105 quit
> Quit
> NX> 999 Bye
> <--- done
> 
> I did not change anything in sshd_config.
> But I downgraded to: openssh-6.9_p1-r2 and nxserver connects OK.
> 
> What could be the problem with new: openssh-7.1_p1-r2

I think the reason is that OpenSSH 7.0 disables ssh-dss keys by default
https://www.gentoo.org/support/news-items/2015-08-13-openssh-weak-keys.html

And and nxserver is using ssh-dss keys by default.

I have to find a way a way to replace the ssh-dss key in: /etc/nxserver/ with RSA one.

Do I just run: ssh-keygen -t rsa
and copy the key pair to /etc/nxserver/ directory? 

--
Thelma