search

pwnesia / ssb

Secure Shell Bruteforcer — A faster & simpler way to bruteforce SSH server
Other
1.25k stars 113 forks source link

Error: handshake failed: ssh: no common algorithm for client to server cipher #15

Closed HAE closed 3 years ago

HAE commented 3 years ago

Hello, Thank you for this useful tool. Here is the problem I'm facing.

Client and server have to agree on a cipher among other things, but I'm trying to test a server and I get the following errors. [ERR] Failed 'admin': ssh: handshake failed: ssh: no common algorithm for client to server cipher; client offered: [aes128-gcm@openssh.com chacha20-poly1305@openssh.com aes128-ctr aes192-ctr aes256-ctr], server offered: [aes128-cbc 3des-cbc aes192-cbc aes256-cbc].

The problem with this is that I have created a ~/.ssh/config file and copied it into the [/etc/ssh_config] and also into /etc/ssh/ssh_config included in the file all available ciphers that are needed.

My understanding is that ssh prioritize the command line options, then the personal directory config file, then the global config file in the /etc directory.

Here is the content of these config files:

Ciphers 3des-cbc,aes128-cbc,aes192-cbc,aes256-cbc,rijndael-cbc@lysator.liu.se,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com
MACs hmac-sha1,hmac-sha1-96,hmac-sha2-256,hmac-sha2-512,hmac-md5,hmac-md5-96,umac-64@openssh.com,umac-128@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64-etm@openssh.com,umac-128-etm@openssh.com
HostKeyAlgorithms ssh-ed25519,ssh-ed25519-cert-v01@openssh.com,sk-ssh-ed25519@openssh.com,sk-ssh-ed25519-cert-v01@openssh.com,ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,sk-ecdsa-sha2-nistp256@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com
KexAlgorithms diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,sntrup4591761x25519-sha512@tinyssh.org

When I directly invoke do ssh it works without any problem, and if I use the [-G] switch the ssh command prints out the current configurations which does indeed show the content the config files above including all cipher entries.

My question is, why does ssb tool show the errors above (of the missing ciphers) even though ssh is configured to use these ciphers available at the remote server?

I may be missing somehting here, or maybe the tool calls ssh in a different manner that does not allow it to load the config file.

Please advice, Thanks

github-actions[bot] commented 3 years ago

This issue won't be fixed & marked as invalid. Closed!