web-dev-qa-db-fra.com

Qu'est-ce que kexalgorithms openssh par défaut?

Si KexAlgorithms n'est pas configuré explicitement dans un fichier de configuration ssh, quel est l'algorithme d'échange de clé par défaut que Opensh peut utiliser? 

La version openssh que j'utilise est OpenSSH_6.4p1.

7
user1097213

Après vérification, cette information peut être obtenue de deux manières.

  1. lire la page de manuel pour sshd_config(5)

    KexAlgorithms
    Specifies the available KEX (Key Exchange) algorithms.
    Multiple algorithms must be comma-separated.
    The default is
    ecdh-sha2-nistp256 ,
    ecdh-sha2-nistp384 ,
    ecdh-sha2-nistp521 ,
    diffie-hellman-group-exchange-sha256 ,
    diffie-hellman-group-exchange-sha1 ,
    diffie-hellman-group14-sha1 ,
    diffie-hellman-group1-sha1 .
    
  2. read from ssh -vvv logs (La première partie correspond au kexalgorithm,hmac,ciphers pris en charge du côté client; la deuxième partie correspond au serveur sshd.)

    debug2: kex_parse_kexinit: diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
    debug2: kex_parse_kexinit: [email protected],[email protected],[email protected],[email protected],ssh-rsa,ssh-dss
    debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,[email protected]
    debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,[email protected]
    debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,[email protected],hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,[email protected],hmac-sha1-96,hmac-md5-96
    debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,[email protected],hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,[email protected],hmac-sha1-96,hmac-md5-96
    debug2: kex_parse_kexinit: none,[email protected],zlib
    debug2: kex_parse_kexinit: none,[email protected],zlib
    debug2: kex_parse_kexinit:
    debug2: kex_parse_kexinit:
    debug2: kex_parse_kexinit: first_kex_follows 0
    debug2: kex_parse_kexinit: reserved 0
    debug2: kex_parse_kexinit: ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
    debug2: kex_parse_kexinit: ssh-rsa
    debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes192-cbc,aes256-cbc,arcfour256,arcfour128,3des-cbc,blowfish-cbc,cast128-cbc,arcfour
    debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes192-cbc,aes256-cbc,arcfour256,arcfour128,3des-cbc,blowfish-cbc,cast128-cbc,arcfour
    debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,[email protected],hmac-ripemd160,hmac-sha1-96,hmac-md5-96,hmac-sha2-256,hmac-sha2-512
    debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,[email protected],hmac-ripemd160,hmac-sha1-96,hmac-md5-96,hmac-sha2-256,hmac-sha2-512
    debug2: kex_parse_kexinit: none,[email protected]
    debug2: kex_parse_kexinit: none,[email protected]
    
  3. requête ssh pour les algorithmes pris en charge: ssh -Q kex server (majuscule -Q)

    diffie-hellman-group1-sha1
    diffie-hellman-group14-sha1
    diffie-hellman-group-exchange-sha1
    diffie-hellman-group-exchange-sha256
    ecdh-sha2-nistp256
    ecdh-sha2-nistp384
    ecdh-sha2-nistp521
    diffie-hellman-group1-sha1
    [email protected]
    
12
user1097213

ssh -G 192.168.1.2 montre la configuration qui inclut kexalgorithms . Par exemple,

kexalgorithms curve25519-sha256,[email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1

Si vous voulez configurer uniquement diffie-hellman-group1-sha1 pour kexalgorithms,

ssh -oKexAlgorithms=diffie-hellman-group1-sha1 [email protected]
0
JaeMann Yeh