cannot connect to Dropbear SSH server

• 报告人: (匿名)
• 属主: (无)
• 类型: Support Request
• 状态: 关闭
• 组件: TTSSH
• 里程碑: (无)
• 优先: 5 - Medium
• 严重性: 5 - Medium
• 处理结果: Invalid
• 文件: 无

Details 回复

This seems to be because some newer versions of SSH have disabled old algorithms that are considered less safe.

The only indication I have is on the server side the log indicates:

Exit before auth from <10.120.???.???:51692>: No matching algo enc c->s

I am not aware how to enable SSH logging in TeraTerm, but I am willing to try that if provided with instructions

Thank you

任务单历史 (3/8 Histories)

2022-03-18 04:41 Updated by: None

• New Ticket "cannot connect to Dropbear SSH server" created

2022-03-18 12:34 Updated by: nmaya

• 组件 Update from (无) to TTSSH
• 类型 Update from Bugs to Support Request

评论 回复

Thank you for your reporting.

If LogLevel in TTSSH section is set to 100, TTSSH outputs log to TTSSH.LOG file.

You can see software versions of each side, and algorithm proposals of each side.

Thanks,

2022-03-18 22:31 Updated by: None

评论 回复

not really sure how to upload file ... fortunately it's not too big

2022-03-18 13:26:13.999Z [19376] ---------------------------------------------------------------------
2022-03-18 13:26:14.003Z [19376] Initiating SSH session
2022-03-18 13:26:14.027Z [19376] Received server identification string: SSH-2.0-dropbear_2020.80
2022-03-18 13:26:14.031Z [19376] Sent client identification string: SSH-2.0-TTSSH/2.92 Win32
2022-03-18 13:26:14.038Z [19376] CRYPT_set_random_data: RAND_bytes call
2022-03-18 13:26:14.042Z [19376] client proposal: KEX algorithm: ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
2022-03-18 13:26:14.047Z [19376] client proposal: server host key algorithm: ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,ssh-rsa,ssh-dss
2022-03-18 13:26:14.051Z [19376] client proposal: encryption algorithm client to server: [e-mail],[e-mail],camellia256-ctr,aes256-ctr,camellia256-cbc,aes256-cbc,camellia192-ctr,aes192-ctr,camellia192-cbc,aes192-cbc,camellia128-ctr,aes128-ctr,camellia128-cbc,aes128-cbc,3des-ctr,3des-cbc,blowfish-ctr,blowfish-cbc,cast128-ctr,cast128-cbc,[e-mail]
2022-03-18 13:26:14.056Z [19376] client proposal: encryption algorithm server to client: [e-mail],[e-mail],camellia256-ctr,aes256-ctr,camellia256-cbc,aes256-cbc,camellia192-ctr,aes192-ctr,camellia192-cbc,aes192-cbc,camellia128-ctr,aes128-ctr,camellia128-cbc,aes128-cbc,3des-ctr,3des-cbc,blowfish-ctr,blowfish-cbc,cast128-ctr,cast128-cbc,[e-mail]
2022-03-18 13:26:14.060Z [19376] client proposal: MAC algorithm client to server: [e-mail],[e-mail],[e-mail],hmac-sha2-512,hmac-sha2-256,hmac-sha1,[e-mail],[e-mail],[e-mail],hmac-md5
2022-03-18 13:26:14.064Z [19376] client proposal: MAC algorithm server to client: [e-mail],[e-mail],[e-mail],hmac-sha2-512,hmac-sha2-256,hmac-sha1,[e-mail],[e-mail],[e-mail],hmac-md5
2022-03-18 13:26:14.068Z [19376] client proposal: compression algorithm client to server: none
2022-03-18 13:26:14.073Z [19376] client proposal: compression algorithm server to client: none
2022-03-18 13:26:14.077Z [19376] CRYPT_set_random_data: RAND_bytes call
2022-03-18 13:26:14.081Z [19376] SSH2_MSG_KEXINIT was sent at SSH2_send_kexinit().
2022-03-18 13:26:14.086Z [19376] SSH2_MSG_KEXINIT was received.
2022-03-18 13:26:14.090Z [19376] server proposal: KEX algorithm: curve25519-sha256,[e-mail],ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group14-sha256,[e-mail]
2022-03-18 13:26:14.094Z [19376] server proposal: server host key algorithm: rsa-sha2-256,ssh-rsa
2022-03-18 13:26:14.098Z [19376] server proposal: encryption algorithm client to server: [e-mail],aes128-ctr,aes256-ctr
2022-03-18 13:26:14.102Z [19376] server proposal: encryption algorithm server to client: [e-mail],aes128-ctr,aes256-ctr
2022-03-18 13:26:14.106Z [19376] server proposal: MAC algorithm client to server: hmac-sha1,hmac-sha2-256
2022-03-18 13:26:14.110Z [19376] server proposal: MAC algorithm server to client: hmac-sha1,hmac-sha2-256
2022-03-18 13:26:14.115Z [19376] server proposal: compression algorithm client to server: [e-mail],none
2022-03-18 13:26:14.119Z [19376] server proposal: compression algorithm server to client: [e-mail],none
2022-03-18 13:26:14.124Z [19376] server proposal: language client to server: 
2022-03-18 13:26:14.128Z [19376] server proposal: language server to client: 
2022-03-18 13:26:14.132Z [19376] KEX algorithm: ecdh-sha2-nistp256
2022-03-18 13:26:14.137Z [19376] server host key algorithm: ssh-rsa
2022-03-18 13:26:14.141Z [19376] encryption algorithm client to server: aes256-ctr
2022-03-18 13:26:14.145Z [19376] encryption algorithm server to client: aes256-ctr
2022-03-18 13:26:14.149Z [19376] MAC algorithm client to server: hmac-sha2-256
2022-03-18 13:26:14.154Z [19376] MAC algorithm server to client: hmac-sha2-256
2022-03-18 13:26:14.158Z [19376] compression algorithm client to server: none
2022-03-18 13:26:14.162Z [19376] compression algorithm server to client: none
2022-03-18 13:26:14.166Z [19376] CRYPT_set_random_data: RAND_bytes call
2022-03-18 13:26:14.170Z [19376] SSH2_MSG_KEX_ECDH_INIT was sent at SSH2_ecdh_kex_init().
2022-03-18 13:26:14.189Z [19376] Terminating SSH session...

(Edited, 2022-03-18 23:47 Updated by: doda)

2022-03-18 22:34 Updated by: None

评论 回复

well, that went bad fast ... please see pastebin ...

https://pastebin.com/saj10XHK

2022-03-19 00:31 Updated by: doda

评论 回复

This looks like a problem on the Dropbear side. This issue has been fixed in Dropbear 2020.81.

c.f. https://matt.ucc.asn.au/dropbear/CHANGES

- Fix regression in 2020.79 which prevented connecting with some SSH 
  implementations. Increase MAX_PROPOSED_ALGO to 50, and print a log 
  message if the limit is hit. This fixes interoperability with sshj 
  library (used by PyCharm), and GoAnywhere.

Please upgrade Dropbear, or disable unused encryption algorithms on Tera Term.

2022-03-19 17:34 Updated by: nmaya

评论 回复

Maybe this change fix this issue.

If you can not update the server software, you have to reduce enabled encryption algorithms to 20 or less.

2022-03-21 21:22 Updated by: None

评论 回复

thanks. I will try that :)

2022-06-25 09:45 Updated by: nmaya

• 状态 Update from 开启 to 关闭
• 处理结果 Update from 无 to Invalid