can you force ssh/d to *only* use AES? - Page 1
Forum section: electronics / general

author: DiTBho
author_rank: Super Contributor
timestamp: March 29, 2023, 11:22:30 am
content: ssh/d can be configured to use a variety of different symmetrical cipher systems { AES, BlowFish, 3DES, CAST128, Arcfour, ... }.The server "sshd" and client "ssh" can both decide (negotiate?) on a list of their supported ciphers, ordered by preference.Most widely used encryption methods in ssh/d are { AES, BlowFish, ... }, but on my router, by default, BlowFish is used if supported by the server, and according to my logs, it looks the only supported method.Weird ... perhaps, because with an "embedded GNU/Linux server" profile ... AES encryption requires significant processor overhead, so someone forced a software method that requires less CPU resourcesAnyway, my router comes with Crypto-hw-Accelerator, but it doesn't implement BlowFish, and from testing ... no way! no ssh and no ssh tunnel will be hw-accelerated, although AES is supported by CryptoDevCode:looking for /dev/crypto0 ... found, okGot cbc(aes) with driver cbc-aes-hifn0CryptoDev AES Test passedOn the same router, OpenVPN perfectly works with cbc-aes-hifn0, so the problem is somewhere with ssh/d.Is it possible - somehow - to force ssh/d to ***only*** use AES?If so, how?

author: shapirus
author_rank: Super Contributor
timestamp: March 29, 2023, 11:51:08 am
content: man sshd_config(and man ssh_config, for the client)/Ciphers

author: DiTBho
author_rank: Super Contributor
timestamp: March 29, 2023, 12:09:39 pm
content: Quote from: shapirus on March 29, 2023, 11:51:08 amalready selected Ciphers { aes128-ctr, aes192-ctr, aes256-ctr, aes128-cbc } in both { /etc/ssh/sshd_config, /etc/ssh/ssh_config }, but it didn't help.still say, AES not supported, and proposes BlowFish.Is there a flag you have to configure when you compile OpenSSH?

author: shapirus
author_rank: Super Contributor
timestamp: March 29, 2023, 12:13:35 pm
content: Well yes, apparently you will have to recompile the client or server that says that AES isn't supported to enable AES support. I guess that's some embedded system build which was compiled with a limited set of supported ciphers, for whatever reason.

author: golden_labels
author_rank: Super Contributor
timestamp: March 31, 2023, 01:45:38 am
content: What does `ssh -Q cipher` say?

author: DiTBho
author_rank: Super Contributor
timestamp: March 31, 2023, 09:22:52 am
content: Quote from: golden_labels on March 31, 2023, 01:45:38 amon my GNU/Linux laptopCode:# ssh -Q cipher3des-cbcaes128-cbcaes192-cbcaes256-cbcrijndael-cbc@lysator.liu.seaes128-ctraes192-ctraes256-ctraes128-gcm@openssh.comaes256-gcm@openssh.comchacha20-poly1305@openssh.com(note blowfish-cbc is missing)on my routerCode:# ssh -Q cipherblowfish-cbc(note blowfish-cbc is the only one listed)I checked out, but do not see a definitive method for selecting AES specifically when using the command line or the settings in /etc/ssh/ssh_client.conf. The connection seems to default to blowfish no matter what you do, probably because it's the only one implemented, which sounds crazy, anyway: what if the client does not support blowfish-cbc?!? you are unable to connect?!?According to this configuration, it really seems that this AES-* cipher is not available because I'm afraid not even implemented, otherwise it would be listedTired of fighting with what other people have done with their autobuilds, I am going to configure with a self made profile (Overlay) and re-compilenet-misc/openssh(v9.2) from scratch both client and server, even if I am more interested about /usr/sbin/sshd (the server) as secure remote shell service the router needs.And before I touch things in /etc/ssh/*config again with the new build, as proof-test I'll try to force ssh to use AES by something likeCode:laptop# ssh -c aes128-cbc ucrouterthe hw-crypto processor in my router supportsaes128aes192aes256so repeating the same test with the crypto-accelerator disabled and then enabled, I should see acceleration as wellWill it work, let's check it out

author: shapirus
author_rank: Super Contributor
timestamp: March 31, 2023, 09:43:20 am
content: Quote from: DiTBho on March 31, 2023, 09:22:52 amThis is sshclient. However, I guess it can be assumed that the server is built with the same set of ciphers (only one cipher actually) too.So blowfish-cbc has been disabled in ssh for a very long time now (since 2014) for being unsafe. Not sure if it's even still in code and just disabled as a compile-time option, or has been removed completely.Apparently your router is very old. The best way to solve it would be to compile (or find a pre-built binary of) a more recent version of ssh server for your router that supports at least one of the ciphers that your ssh client supports. Second best would be to find/build an older standalone ssh binary for your computer that you can use to ssh into your router.

author: DiTBho
author_rank: Super Contributor
timestamp: March 31, 2023, 11:22:21 am
content: Quote from: shapirus on March 31, 2023, 09:43:20 amyup, on the router, both belongs to the same net-misc/openssh ebuild, both were compiled with the same profile.Quote from: shapirus on March 31, 2023, 09:43:20 amthat's what I have to understand.a) enabled/disabled due to a compile-time configure flag?b) enabled/disabled due to a compile-time patch?I see a lot of patches applied to net-misc/opensshCode:HPN_VER="15.2"HPN_PATCHES=(${PN}-${HPN_PV/./_}-hpn-DynWinNoneSwitch-${HPN_VER}.diff${PN}-${HPN_PV/./_}-hpn-AES-CTR-${HPN_VER}.diff${PN}-${HPN_PV/./_}-hpn-PeakTput-${HPN_VER}.diff)HPN_GLUE_PATCH="${PN}-9.2_p1-hpn-${HPN_VER}-glue.patch"HPN_PATCH_DIR="HPN-SSH%%20${HPN_VER/./v}%%20${HPN_PV/_P/p}"SCTP_VER="1.2"SCTP_PATCH="${PARCH}-sctp-${SCTP_VER}.patch.xz"X509_VER="14.1"X509_PATCH="${PARCH}+x509-${X509_VER}.diff.gz"X509_GLUE_PATCH="${P}-X509-glue-${X509_VER}.patch"X509_HPN_GLUE_PATCH="${PN}-9.2_p1-hpn-${HPN_VER}-X509-${X509_VER}-glue.patch"DESCRIPTION="Port of OpenBSD's free SSH release"HOMEPAGE="https://www.openssh.com/"SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz${SCTP_PATCH:+sctp? ( https://dev.gentoo.org/~chutzpah/dist/openssh/${SCTP_PATCH} )}PATCHES=("${FILESDIR}/${PN}-7.9_p1-include-stdlib.patch""${FILESDIR}/${PN}-8.7_p1-GSSAPI-dns.patch" #165444 integrated into gsskex"${FILESDIR}/${PN}-6.7_p1-openssl-ignore-status.patch""${FILESDIR}/${PN}-7.5_p1-disable-conch-interop-tests.patch""${FILESDIR}/${PN}-8.0_p1-fix-putty-tests.patch""${FILESDIR}/${PN}-8.0_p1-deny-shmget-shmat-shmdt-in-preauth-privsep-child.patch""${FILESDIR}/${PN}-8.9_p1-allow-ppoll_time64.patch" #834019"${FILESDIR}/${PN}-8.9_p1-gss-use-HOST_NAME_MAX.patch" #834044)(basic patches)plus other patches for the "hardened" profileplus other patches for the "embedded" profile****** too many patches, d'oh******Quote from: shapirus on March 31, 2023, 09:43:20 am2023-03 built:=net-misc/openssh-v9.2=dev-libs/openssl-v3.0.8according to current profile, they are 39 days older; probably it's the profile that is *VERY* old, so the person who prepared the Catalyst profile, used a very old profile on recent packages.Quote from: shapirus on March 31, 2023, 09:43:20 amI always compile things myself, this time I didn't look at the profile used for { net-misc/openssh,dev-libs/openssl, sys-libs/zlib, ... } ssh and I simply "copied" (never copy&paste --> never, don't be lazy!!!) it and added it to the things Catalyst had to compile, with the result that whoever prepared it ... evidently made some strange choices and not documented.So, I don't know what? why? how? ... but this time I'm taking two days to write my own profile, and recompile the whole set of packages.

author: DiTBho
author_rank: Super Contributor
timestamp: March 31, 2023, 11:30:35 am
content: Found an interesting noteQuote

author: DiTBho
author_rank: Super Contributor
timestamp: March 31, 2023, 12:23:41 pm
content: for testing purposes, is there a way to force ssh (client and server) to use a "dummy cipher"?Code:dummy_cipher(x){return x;}

author: shapirus
author_rank: Super Contributor
timestamp: March 31, 2023, 01:04:58 pm
content: Quote from: DiTBho on March 31, 2023, 12:23:41 pmThere used to be, but disabled since. I don't remember how it was called.It looks like the "embedded" patch set is what you're after to disable. Its name implies that it might be removing "unnecessary" stuff to reduce the (both disk and memory) size of the binaries.

author: golden_labels
author_rank: Super Contributor
timestamp: March 31, 2023, 04:20:01 pm
content: I believe it was OpenSSL that had a no-encryption cipher,(1)not OpenSSH.Blowfish was neither turned off or patched out. It was never implemented in the first place for version 2 of the SSH protocol. AndOpenSSH support for SSH version 1 was deleted in 2017. I do not know about implementations other than OpenSSH.My guess is that the router uses software cut down as much as possible to save space. Why did they choose that set of features is a mystery to me: SSHv1 and Blowfish were known to be sinking fast even before OpenSSH removed it.If you are going to recompile, consider the GCM mode instead of CBC or CTR. Unless you have a particular reason not to. GCM mode offers message authentication, so there is no need to apply a separate MAC.(1)In OpenSSL it isNULL.

author: DiTBho
author_rank: Super Contributor
timestamp: March 31, 2023, 04:42:52 pm
content: Quote from: golden_labels on March 31, 2023, 04:20:01 pmCode:src # unpack /distfiles/openssh-9.2p1.tar.gzsrc # cd openssh-9.2p1src/openssh-9.2p1 # grep blowfish * -ropenbsd-compat/Makefile.in: blowfish.o \openbsd-compat/blf.h: * Warning: For normal blowfish encryption only 56 bytesopenbsd-compat/blowfish.c:/* $OpenBSD: blowfish.c,v 1.20 2021/11/29 01:04:45 djm Exp $ */regress/conch-ciphers.sh: cast128-cbc blowfish 3des-cbc ; doI haven't yet looked at these files, but it seems blowfish is still there, perhaps hidden

author: DiTBho
author_rank: Super Contributor
timestamp: March 31, 2023, 04:51:23 pm
content: Quote from: golden_labels on March 31, 2023, 04:20:01 pmThanks!I am also considering a multi-profile, one withhpnenabled./usr/bin/ssh, /usr/sbin/sshd <---------------- common OpenSSH using ssl/usr/bin/hpn-ssh, /usr/sbin/hpn-sshd <------ HPN-SSH is a series of modifications to OpenSSHFor this interesting feature:Quote

author: golden_labels
author_rank: Super Contributor
timestamp: March 31, 2023, 06:07:23 pm
content: Quote from: DiTBho on March 31, 2023, 04:42:52 pmThis seems to me like an implementation of Blowfish as a cryptographic primitive, not a cipher as used by SSH for encrypting connections. As a primitive it must be present for bcrypt (see “openbsd-compat/bcrypt_pbkdf.c”).

author: DiTBho
author_rank: Super Contributor
timestamp: April 01, 2023, 01:35:19 pm
content: so, there is a "weak-ssl-ciphers" patch to disable all the support for SSL/TLS ciphers that are considered "weak"Quote

author: DiTBho
author_rank: Super Contributor
timestamp: April 01, 2023, 04:56:20 pm
content: Code:2023-03-31--12-50-26---2023-04-01--00-19-54 - [ net-misc/openssh ] - success - root@dev2.40.0/4.8.3successfully rebuilt, all tests passedCode:# ssh -Q cipher cipher3des-cbcaes128-cbcaes192-cbcaes256-cbcaes128-ctraes192-ctraes256-ctrnow it looks good!while editing profile, I found an interesting noteQuote

author: shapirus
author_rank: Super Contributor
timestamp: April 01, 2023, 05:14:40 pm
content: yeah, heed that warning.pay attention to your passwords (just make them ridiculously long and use a password manager), stop using passwords at all and use key authentication, disable your ssh port for anything beyond a whitelisted set of addresses.

author: golden_labels
author_rank: Super Contributor
timestamp: April 02, 2023, 12:27:04 am
content: Quote from: DiTBho on April 01, 2023, 04:56:20 pmNot allowing password authentication and disabling root makes the attacks almost impossible too. Moving the service to a non-default port is also a good idea. It does not provide real security, but drops amount of spam in logs to almost zero.

author: ejeffrey
author_rank: Super Contributor
timestamp: April 02, 2023, 03:19:19 am
content: I wouldn't bother with changing the port, and even stuff like fail2ban are pretty questionable. These only block the low sophistication attacks and if you rely on them you will get hacked by high sophistication attacks. If you protect against high sophistication attacks you don't need to worry about the easy stuffThere were botnets 15 years ago already that did distributed SSH brute force at a low rate to avoid IP based rate limiting. But i've been locked out plenty of times by overzealous fail2ban use. Rate limiting is a great idea it's just important to think about how to avoid turning into a DoS.Disabling root login and disabling password login if you can't ensure users use strong and unique passwords is real security and if you have that you don't really need to bother with the other stuff.

author: DiTBho
author_rank: Super Contributor
timestamp: April 02, 2023, 01:47:29 pm
content: This note aboutdev-libs/opensslis also interestingQuoteBasically -> v1.1.1 ---> v3.0.8

author: golden_labels
author_rank: Super Contributor
timestamp: April 02, 2023, 06:22:46 pm
content: Quote from: ejeffrey on April 02, 2023, 03:19:19 amIt was very clearly stated, that changing port is not meant to increase security. It can’t block “low sophistication attacks” either, as it does not affect the attack, once one is already being conducted. The purpose of changing the port to an uncommon value is — I will repeat that part too — removing noise from logs. The only security benefit is reducing discoverability in untargeted scans, and whatever one gets from higher quality logs.

author: abeyer
author_rank: Frequent Contributor
timestamp: April 02, 2023, 08:17:22 pm
content: Quote from: DiTBho on April 02, 2023, 01:47:29 pmGiven the known insecurities you've already found, I'd questioneverythingelse on there, too. If you aren't able/willing to upgrade the distro altogether, I'd at least suggest looking at every version of every installed package and check again known issues.

author: golden_labels
author_rank: Super Contributor
timestamp: April 03, 2023, 03:36:59 am
content: Quote from: DiTBho on April 02, 2023, 01:47:29 pmDo not be too scared, though. WhileOpenSSL 1.x is reaching EOL in September 2023and it should be replaced, there was no gap. 3.0 is the first release available after 1.1.1. It’s also the LTS version, so there is no security implications of not going to 3.1 line. The bigger issue would be to have a low letter at the end of 1.1.1 version.

author: DiTBho
author_rank: Super Contributor
timestamp: April 03, 2023, 09:07:26 am
content: Quote from: golden_labels on April 03, 2023, 03:36:59 amCode:rU dev-libs/openssl v3.0.8-r3 v1.1.1srU dev-lang/python v3.10.10_p3 v3.10.9-r1rR net-misc/rsync v3.2.4-r3rR net-misc/wget v1.21.3-r1rU dev-lang/python v3.11.2_p2 v3.11.1-r1rR net-misc/curl v7.87.0-r2rU net-misc/openssh v9.2_p1-r2 v9.1_p1rU app-portage/portage-utils v0.95 v0.94.3rR net-vpn/vtun v3.0.4-r2This is the dev-libs/openssl update impact analysis.Not bad, and it only costs a day to cross-compile on a tiny mac-mini/x86 cluster

author: DiTBho
author_rank: Super Contributor
timestamp: April 10, 2023, 06:07:47 am
content: so, after testing ...=dev-libs/openssl-3.0.8 supports "blowfish" via "legacy" engines, but it has a terrible bug detecting the dev-crypto hashing method and is not always recognized during sessions, which causes ssh connections to randomly close.=dev-libs/openssl-1.0.2u compiles and works, but its Makefile doesn't respect "make install DESTDIR", the DESTDIR rule is not always respected, and this causes QA SandBox Access Violation ... so it fails on Catalystmoral of the story, I am back with =dev-libs/openssl-1.1.1t-r3By switching from =dev-libs/openssl-3.0.* to =dev-libs/openssl-1.1.* you need to rebuild { sys-apps/coreutils, net-misc/wget, net-misc/curl, dev-libs/libevent } packages because they have a dependency with a specific version of =dev-libs/openssl-*e.g.Code:# ldd /usr/bin/curllibssl.so.1.1 => /usr/lib/libssl.so.1.1 (0x77ac0000)libcrypto.so.1.1 => /usr/lib/libcrypto.so.1.1 (0x77860000)libssl.so.1.0, libcrypto.so.1.0 ----> =dev-libs/openssl-1.0.*libssl.so.1.1, libcrypto.so.1.1 ----> =dev-libs/openssl-1.1.*libssl.so.3.1, libcrypto.so.3.0 ----> =dev-libs/openssl-3.0.*p.s.net-misc/openssh needs to be "hacked" in order to enable the "none" cipher since it's already supported by only for internal use.Code:# ssh -Q ciphersaes128-cbcaes192-cbcaes256-cbcaes128-ctraes192-ctraes256-ctrnonenow the stage4 is *exactly* as I want it to be