ssh jump fail abou banner invalid characters

Question

Updated sshd journal on both jumphost and jumptarget

---

Full logs are too long to be pasted. uploaded to gist

three files are logs that :

Local -> Jumpper -> Debian by ssh -j

Local -> Jumpper -> Debian by ssh Debian

Local -> Jumpper by ssh jumpper

Jumper -> Debian by ssh 10.10.10.3

FYI: During this time, the IP address was re-planned 10.10.1.3 -> 10.10.10.3, and a domain was added in the hosts. These shouldn't have any effect on the problem.

---

A similar problem is SSH ProxyJump on macOS Catalina is not working. but the answer doesn't solve my case

I'm configuring ssh jump with the following configures:

Host Jumper
    HostName domainName
    User username
    Port 1234

Host Debian
    HostName 10.10.1.3
    User username
    Port 22
    ProxyJump Jumper

The result of ssh Debian -vvv is

...
debug1: kex_exchange_identification: banner line 0: \033(B\033[mSSH-2.0-OpenSSH_9.2p1 Debian-2
kex_exchange_identification: banner line contains invalid characters
...

it shows OpenSSH, so I think the port should be correct

ssh Jumper is fine, and manully ssh 10.10.1.3 on jumper is also fine.

Answer 1

EDIT

At the first glance, I've been misslead by the keyword "banner" and the ANSI sequence. I do not delete but update this answer to preserve the helpful comments below.
Please regard this answer as a comment.

---

As roaima pointed out the Banner defined in sshd_config gets displayed at the beginning of the authentication, but your debug message is a result of kex-exchange that is done just before auth.

Also check Kamil Maciorowski, linked hint. — The tested string is part of the compiled code.

---

To find out more please activate at least debug level 1 by changing the /etc/ssh/sshd_config:

LogLevel DEBUG1

• Restart your sshd by systemctl restart sshd
• Note that at Debian any settings in /etc/ssh/sshd_config.d/*.conf will take precedence over those in /etc/ssh/sshd_config (the first match takes control).

Of interest are these entries and their neighbours:

File: /var/log/auth.log

Sep 17 01:03:43 lamp sshd[1861]: Connection from 192.168.0.1 port 43854 on 192.168.0.2 port 22 rdomain ""
Sep 17 01:03:43 lamp sshd[1861]: debug1: Local version string SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u1
Sep 17 01:03:43 lamp sshd[1861]: debug1: Remote protocol version 2.0, remote software version OpenSSH_9.2p1 Debian-2
Sep 17 01:03:43 lamp sshd[1861]: debug1: match: OpenSSH_9.2p1 Debian-2 pat OpenSSH* compat 0x04000000

• Please do retrieve this at the JumpHost and the Destination Host (Debian) for the same connection attempt and update your question by the log results.
• Also add the related output of localhost using ssh Debian -vvv (more than just the error to see the context)
• It might be useful to also add the log of a ssh to the JumpHost itself, if there's a difference.
• Same optional interest to the ssh connection JumpHost > Destination Host

Awaiting the results ...

---

Regarding the above, the point that the match for OpenSSH* is searched the relevance of some preceding "ANSI escape codes with typos" reduces to "some garbage that must not be there".

---

Your banner line contains a typo: Should be [ in \033(B, but not not (.

# Your line:
\033(B\033[mSSH-2.0-OpenSSH_9.2p1 Debian-2

# Fixed line:
\033[B\033[mSSH-2.0-OpenSSH_9.2p1 Debian-2

\033[B    # tells "Move Cursor down" 
\033[m    # reset the ANSI colors

Part of the original answer, but most likely not the solution for the question (see above):

Configure the banner of OpenSSH Server

The file is configured in /etc/ssh/sshd_config or /etc/ssh/sshd_config.d/*.conf:

Banner FileName

Did you find such an entry and the configured file?

Disable the banner by Banner none (and restart the sshd).

This has to be checked at both involved sshd: the JumpHost and the destination.