search

staf621 / ki4a

Ki4a lets you tunnel your android's traffic over SSH in a very easy way.
Apache License 2.0
87 stars 52 forks source link

Update openssh MAC algorithims #21

Open hestela opened 6 years ago

hestela commented 6 years ago

I got this error message in my openssh server: Jul 10 14:29:27 machine sshd[11022]: Unable to negotiate with ipaddr port 25555: no matching MAC found. Their offer: hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96 [preauth]

My server is using openssh-7.6p1. Many of the MACs supported by this app are considered insecure. A newer MAC algorithm should be added. Something like hmac-sha2-512-etm@openssh.com

some output from ssh-audit.py:

(mac) hmac-md5                              -- [fail] removed (in server) since OpenSSH 6.7, unsafe algorithm
                                            `- [warn] disabled (in client) since OpenSSH 7.2, legacy algorithm
                                            `- [warn] using encrypt-and-MAC mode
                                            `- [warn] using weak hashing algorithm
                                            `- [info] available since OpenSSH 2.1.0, Dropbear SSH 0.28
(mac) hmac-sha1                             -- [warn] using encrypt-and-MAC mode
                                            `- [warn] using weak hashing algorithm
                                            `- [info] available since OpenSSH 2.1.0, Dropbear SSH 0.28
(mac) umac-64@openssh.com                   -- [warn] using encrypt-and-MAC mode
                                            `- [warn] using small 64-bit tag size
                                            `- [info] available since OpenSSH 4.7

i had to remove: hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96 to get my sshd process to start

app error log:

[libsuperuser][O][SH*] no matching mac found: client hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96 server hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,umac-128@openssh.com
[libsuperuser][O][SH-] 255
[libsuperuser][C][SH%] END
Disconnected