search

michaellukashov / Far-NetBox

SFTP/SCP/FTP/FTPS/WebDAV/S3 client for Far Manager 3 (http://farmanager.com/)
https://forum.farmanager.com/viewtopic.php?t=6317
GNU General Public License v2.0
159 stars 52 forks source link

Diffie-Hellman group exchange KEX is obsolete #156

Open mmozeiko opened 9 years ago

mmozeiko commented 9 years ago

OpenSSH 6.9 version have disabled obsolete form of KEX "Diffie-Hellman group exchange" algorithm (source and this). sshd log shows "sshd error Hm, kex protocol error: type 30 seq 1 [preauth]" message when NetBox tries to connect to it.

Using NetBox to connect such server simply hangs forever. One solution is to move "Diffie-Hellman group exchange" KEX to last position in "Algorithm selection policy" setting. Preferably "ECDH key exchange" like in putty should be implemented.

VictorVG commented 9 years ago

Please, temporary disable this options. WinSCP based old PuTTY code and can't full support new OpenSSL 1.02d changes. Yesterday I watched with a time delay after the OpenSSL ToolKit output supports his version of WinSCP and I get it about a week, sometimes longer, and in the new OpenSSL v1.0.2d eliminate the risk of the vulnerability CVE-2015-1793 (http://www.openssl.org/news/secadv_20150709.txt) which is not eliminated in PuTTY / WinSCP.

mmozeiko commented 9 years ago

I'm pretty sure this has nothing to do with OpenSSL and CVE-2015-1793. This is OpenSSH change that happened in 6.9 version. Here's the same problem reported on WinSCP forum: https://winscp.net/forum/viewtopic.php?t=15626

VictorVG commented 9 years ago

Yes, I've seen it since yesterday a similar question was asked in http://forum.ru-board.com/topic.cgi?forum=5&topic=31718&start=7040#2 and one of the solutions found - update Far. In fact, it would be necessary to correct the WinSCP and PuTTY, and NetBox is bypassing the mistakes of others that we can not guarantee that they will not get out again later.

mmozeiko commented 9 years ago

When I try to update Far to latest nightly build (4401) - it crashes when connecting to scp/sftp server:

Exception:   Access violation (write to 0x00007FFFA9FA4C48)
Address:     0x00007FFFA9F04393
Function:    ProcessPanelInputW

Not sure if needed, but I tried deleting pluginchache64/32.db - it doesn't help. Still a crash. Currently I'm using 4378 build which works fine if I move down DH group exchange in Algorithm selection policy.

VictorVG commented 9 years ago

This error is known - http://bugs.farmanager.com/view.php?id=3018 and naturally corrected.

VictorVG commented 9 years ago

Please, check v2.1.43.392 - links - https://github.com/michaellukashov/Far-NetBox/issues/155#issuecomment-120160217

mmozeiko commented 9 years ago

With that 4401 build doesn't crash on connect. I still need to disable DH group exchange KEX. But at then end of authentication it shows "Incorrect or damaged C:\Program Files\Far Manager\Plugins\NetBox\NetBoxEng.lng Message 2106 not found" error and exits connection.

VictorVG commented 9 years ago

SHA-256 for NetBoxEng.lng and NetBoxRus.lng is:

a2a958b7d13fe50105aa9ee1faabe7a74e72e7331c2b1bafc6de6771003bfa9c NetBoxEng.lng 2e21bfc8169d2d0feddee7284e73038c1623f5d251776521c02930523f8a200c NetBoxRus.lng

.lng files not changes after v2.1.43.390. Please, check local copy...

mmozeiko commented 9 years ago

Yes, NetBoxEng.lng has correct checksum (a2a9...fa9c). Replacing it with NetboxRus.lng gives me same error. If it helps, here's the output from NetBox log if I enable "Debug 2" level: http://pastebin.com/gjMfRnmh

VictorVG commented 9 years ago

Yes, it seems really language modules is to look for improvements.

VictorVG commented 9 years ago

Added - http://forum.farmanager.com/viewtopic.php?p=131198#p131198 some problems...

VictorVG commented 9 years ago

For testing:

NetBox 2.1.43.393 15.07.2015

https://yadi.sk/d/JFdKIO3-hmx4o FarNetBox-2.1.43_Far3_x64.7z https://yadi.sk/d/KoBPaavdhmx69 FarNetBox-2.1.43_Far3_x86.7z

Please, tell us about the result of the checking!

VictorVG commented 9 years ago

Устранено в рамках http://bugs.farmanager.com/view.php?id=3018

Думаю что можно вслед за Мантис#3018 и #155 закрыть.

mmozeiko commented 9 years ago

Yes now nightly build (4401) works fine with 2.1.43.393 NetBox. Of course if I disable DH group exchange as before.

VictorVG commented 9 years ago

Well, with the DH as the only mistake it is easier ...

VictorVG commented 9 years ago

Мантис#3018 отработан, но с чего выплыл http://bugs.farmanager.com/view.php?id=3028 ?

vladimirmartsul commented 9 years ago

Судя по всему, в current'е PuTTY (0,65) http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/rfc4419.html и WinSCP (5.7.5 (not released yet)) пофиксили http://winscp.net/tracker/show_bug.cgi?id=1345 Очень хочется реализации в рамках Netbox'а.