<div dir="ltr">Hi everybody,<div><br></div><div>here is my report for further examinations on this topic. I have the following sshd_config (as requested form Aaron):<br><br><a href="https://gist.github.com/andywenk/fa461dbaf2abf3442a3a">https://gist.github.com/andywenk/fa461dbaf2abf3442a3a</a><br>
</div><div><br></div><div>As you can see, the three configuration paramaters Ciphers, MACs and KexAlgorithms are commented out. When activating the Ciphers solely and testing the configuration ( /usr/sbin/sshd -t) I get:<br>
<br>/etc/ssh/sshd_config line 90: Bad SSH2 cipher spec '<a href="mailto:aes256-gcm@openssh.com">aes256-gcm@openssh.com</a>,<a href="mailto:aes128-gcm@openssh.com">aes128-gcm@openssh.com</a>,aes256-ctr,aes128-ctr'.<br>
</div><div><br></div><div>When activation MACs solely and testing the configuration I get:</div><div><br></div><div>/etc/ssh/sshd_config line 93: Bad SSH2 mac spec '<a href="mailto:umac-128-etm@openssh.com">umac-128-etm@openssh.com</a>,hmac-sha2-512,hmac-sha2-256,hmac-ripemd160'.<br>
</div><div><br></div><div>Finally, when activating KexAlgorithms solely and testing I get:</div><div><br></div><div>/etc/ssh/sshd_config line 96: Bad SSH2 KexAlgorithms '<a href="mailto:curve25519-sha256@libssh.org">curve25519-sha256@libssh.org</a>,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1'.<br>
</div><div><br></div><div>So either I have a typo or something, because copying from the PDF is not possible, or my system can not deal with these or some of these settings. But as this is a quite new Ubuntu, I propose to add more information to the section 2.2.1 OpenSSH in the way, that a user can see on which machines this is working. <br>
<br>I would be happy to help here if it is clearer for me:</div><div><br></div><div>/ what the problem is with my configuration</div><div>/ how I or a user can test exactly if the settings are working or not</div><div><br>
</div><div>Best</div><div><br></div><div>Andy</div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On 3 January 2014 18:26, Andy Wenk <span dir="ltr"><<a href="mailto:andy@nms.de" target="_blank">andy@nms.de</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div class="gmail_extra"><div class="gmail_quote"><div><div class="h5">On 3 January 2014 16:59, Aaron Zauner <span dir="ltr"><<a href="mailto:azet@azet.org" target="_blank">azet@azet.org</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Hi Andy,<br>
<div><br>
> Following the instructions in 2.2.1. OpenSSH of the draft document, I added the settings for Ciphers, MACs and KexAlgorithms to /etc/ssh/sshd_config of my Ubuntu 12.04.3 LTS box. Unfortunately after having restarted the service (service ssh restart), I was not able to login to the box via ssh. So my question is: how do I have to create the ssh keys to be able to login. Her is the output I receive when trying to login:<br>
<br>
</div>Could you send the whole /etc/sshd_config file as well as the output to the whole connection with verbose debugging (-vvv)?<br></blockquote><div><br></div></div></div><div>Hi Aaron,</div><div><br></div><div>I habe to examin this a little more and will then report ...</div>
<div><br></div><div>Thanks for your help!</div><div><br></div><div>Cheers</div><span class="HOEnZb"><font color="#888888"><div><br></div><div>Andy </div></font></span></div><div class="im"><br clear="all"><div><br></div>
-- <br><div dir="ltr">Andy Wenk<br>Hamburg - Germany<br>RockIt!<br><br><a href="http://www.couchdb-buch.de" target="_blank">http://www.couchdb-buch.de</a><br>
<a href="http://www.pg-praxisbuch.de" target="_blank">http://www.pg-praxisbuch.de</a><br><br><div><div>GPG fingerprint: <span style="white-space:pre-wrap">C044 8322 9E12 1483 4FEC 9452 B65D 6BE3 9ED3 9588</span></div>
</div><div><span style="white-space:pre-wrap"><br></span></div><div><font color="#000000"><span style="white-space:pre-wrap"><a href="https://people.apache.org/keys/committer/andywenk.asc" target="_blank">https://people.apache.org/keys/committer/andywenk.asc</a></span></font><br>
</div></div>
</div></div></div>
</blockquote></div><br><br clear="all"><div><br></div>-- <br><div dir="ltr">Andy Wenk<br>Hamburg - Germany<br>RockIt!<br><br><a href="http://www.couchdb-buch.de" target="_blank">http://www.couchdb-buch.de</a><br><a href="http://www.pg-praxisbuch.de" target="_blank">http://www.pg-praxisbuch.de</a><br>
<br><div><div>GPG fingerprint: <span style="color:rgb(0,0,0);white-space:pre-wrap">C044 8322 9E12 1483 4FEC 9452 B65D 6BE3 9ED3 9588</span></div></div><div><span style="color:rgb(0,0,0);white-space:pre-wrap"><br></span></div>
<div><font color="#000000"><span style="white-space:pre-wrap"><a href="https://people.apache.org/keys/committer/andywenk.asc" target="_blank">https://people.apache.org/keys/committer/andywenk.asc</a></span></font><br></div>
</div>
</div>