0

I've been using SSH on daily basis for years, but prior to moving to my current job, I didn't really have to deal with obsolete and weak ciphers, or to mess much with SSH configuration. Back when I was using Ubuntu 20.04 and Debian 11, I could have get away with just allowing suggested Kex Algorithms (-oKexAlgorithms command line parameter), but after upgrading to Debian 12, some ages old servers just act as the network is unreachable.

kex_exchange_identification: read: Connection reset by peer

I don't care if they get hacked, their obsolete and weak ciphers are not my problem, I just want to get my work done by connecting to them.

How do I configure my /etc/ssh/ssh_config so that it allows me to connect to just about anything?

1 Answer 1

2

some ages old servers just act as the network is unreachable.

kex_exchange_identification: read: Connection reset by peer

That's not acting as if unreachable, that's literally the other end establishing a connection, and then going "nah, I'm done here, shut up".

You'll need to use -vv when running SSH to figure out what the server offers in ciphers, and probably manually enable one of these. If your client doesn't have any of them available anymore, then that pretty certainly means it's a bad idea to use them. And you know that! So, yeah, in that case, you're on your own with this with no support from your distro to do "stupid things".

I don't care if they get hacked, their obsolete and weak ciphers are not my problem,

I'm honestly not in your camp there. This "not my department" mentality is what makes systems never get updated before a company loses customer data to some criminal, or worse. I'm one of these customers, who end up getting spam and fishing attacks because someone thought a server update can't be that high priority. So, my empathy for admins not updating their servers, and people paid to work on these servers not causing a ruckus, is very limited. The amount of work it costs me to filter through the spam I get as a direct result of that is significant.

At the very least, drop an email to the administrator. (That amount of paper trail pointing out problems by the way also a necessity to cover your own behind when excrement hits the rotary air impeller.)

By the way, they are your problem, as soon as someone starts using your SSH session that they intercepted.

I just want to get my work done by connecting to them.

That I can fully understand. If you can't enable the ciphers, you'll have to build an SSH client where you can. Again, you're on your own there.

So, get the debian source package (apt-get source openssh-client), get the build-dependencies for it (apt-get build-dep openssh-client), make the necessary changes to the configuration to enable the obsolete ciphers, rebuild the package (dpkg-buildpackage). Install the result! You probably pin the version (apt-mark hold) afterwards to inhibit your debian from replacing your manually-insecured ssh client from being updated.

3
  • At first it seemed as the packages were dropped by the firewall, but then I did -vvv and got this result to post here: kex_exchange_identification: read: Connection reset by peer I would really like these servers to be upgraded to the latest LTS of their respective distributions and so it is, whenever I'm in charge of servers, but I have no say when it comes to these. Nov 2, 2023 at 14:26
  • yes, again, I explained what you need to check the output for. If the servers don't tell you what they support, then you're out of luck, and you need to insist they are upgraded, because you simply can't work them otherwise. Not your problem. Nov 2, 2023 at 14:37
  • With some old SSH servers, the problem is that the new SSH clients have so many options to negotiate that they overrun the server-side buffer for negotiable options. In that situation, the old server figures "okay, you're trying to do something naughty like a buffer overflow attack. Get lost." and closes the connection immediately. The workaround is to specify a smaller set of options to negotiate - maybe just one or two algorithms of each type - so the old server will believe that you're at least trying to negotiate in good faith, and responds with the options it will support.
    – telcoM
    Nov 2, 2023 at 23:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .