fatal: DH_GEX_REQUEST, bad parameters: 2048 !< 1024 !< 8192

NeilZhang
NeilZhang
管理员
140
文章
106.8千
浏览
Linux评论1,132字数 1291阅读4分18秒阅读模式

These days got an issue that some AIX servers could not access one Linux server:

  1. ------@------:/home/------/.ssh$ssh 192.168.3.66
  2. Connection closed by 192.168.3.66

(I removed the hostname and username).

From the ssh server, I found more detail reason:

  1. sshd[17834]: fatal: DH_GEX_REQUEST, bad parameters: 2048 !< 1024 !< 8192

Also could verify such error from the client side:

  1. ------@------:/home/------/.ssh$ssh -vvv 192.168.3.66
  2. OpenSSH_6.0p1, OpenSSL 1.0.2m  2 Nov 2017
  3. debug1: Reading configuration data /etc/ssh/ssh_config
  4. debug1: Failed dlopen: /usr/krb5/lib/libkrb5.a(libkrb5.a.so): Could not load module /usr/krb5/lib/libkrb5.a(libkrb5.a.so).
  5. System error: No such file or directory
  6.  
  7. debug1: Error loading Kerberos, disabling Kerberos auth.
  8. debug2: ssh_connect: needpriv 0
  9. debug1: Connecting to 192.168.3.66 [192.168.3.66] port 22.
  10. debug1: Connection established.
  11. debug3: Incorrect RSA1 identifier
  12. debug3: Could not load "/home/------/.ssh/id_rsa" as a RSA1 public key
  13. debug1: identity file /home/------/.ssh/id_rsa type 1
  14. debug1: identity file /home/------/.ssh/id_rsa-cert type -1
  15. debug1: identity file /home/------/.ssh/id_dsa type -1
  16. debug1: identity file /home/------/.ssh/id_dsa-cert type -1
  17. debug1: identity file /home/------/.ssh/id_ecdsa type -1
  18. debug1: identity file /home/------/.ssh/id_ecdsa-cert type -1
  19. debug1: Remote protocol version 2.0, remote software version OpenSSH_5.3
  20. debug1: match: OpenSSH_5.3 pat OpenSSH_5*
  21. debug1: Enabling compatibility mode for protocol 2.0
  22. debug1: Local version string SSH-2.0-OpenSSH_6.0
  23. debug2: fd 3 setting O_NONBLOCK
  24. debug3: load_hostkeys: loading entries for host "192.168.3.66" from file "/home/------/.ssh/known_hosts"
  25. debug3: load_hostkeys: loaded 0 keys
  26. debug1: SSH2_MSG_KEXINIT sent
  27. debug1: SSH2_MSG_KEXINIT received
  28. debug2: kex_parse_kexinit: ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
  29. debug2: kex_parse_kexinit: ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-rsa-cert-v00@openssh.com,ssh-dss-cert-v00@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss
  30. debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se
  31. debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se
  32. debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-sha2-256,hmac-sha2-256-96,hmac-sha2-512,hmac-sha2-512-96,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
  33. debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-sha2-256,hmac-sha2-256-96,hmac-sha2-512,hmac-sha2-512-96,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
  34. debug2: kex_parse_kexinit: none,zlib@openssh.com
  35. debug2: kex_parse_kexinit: none,zlib@openssh.com
  36. debug2: kex_parse_kexinit:
  37. debug2: kex_parse_kexinit:
  38. debug2: kex_parse_kexinit: first_kex_follows 0
  39. debug2: kex_parse_kexinit: reserved 0
  40. debug2: kex_parse_kexinit: diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
  41. debug2: kex_parse_kexinit: ssh-rsa,ssh-dss
  42. debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se
  43. debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se
  44. debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
  45. debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
  46. debug2: kex_parse_kexinit: none,zlib@openssh.com
  47. debug2: kex_parse_kexinit: none,zlib@openssh.com
  48. debug2: kex_parse_kexinit:
  49. debug2: kex_parse_kexinit:
  50. debug2: kex_parse_kexinit: first_kex_follows 0
  51. debug2: kex_parse_kexinit: reserved 0
  52. debug2: mac_setup: found hmac-md5
  53. debug1: kex: server->client aes128-ctr hmac-md5 none
  54. debug2: mac_setup: found hmac-md5
  55. debug1: kex: client->server aes128-ctr hmac-md5 none
  56. debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(2048<1024<8192) sent
  57. debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
  58. Connection closed by 192.168.3.66

I found below useful note from Novell:

ssh and sftp client failures after updating openssh package

And I knew the OpenSSH was upgraded within several months on these AIX servers, so this issue should be an compatibility issue as the client only accepted host key at least 2048 bits or more while the server with lower version and preferred 1024 bit.

One workaround was using parameter KexDHMin or KexAlgorithms. On AIX I have to use the latter one as it is the only supported one.

  1. ------@------:/home/------/.ssh$ssh -o KexAlgorithms=diffie-hellman-group14-sha1 192.168.3.66
  2. The authenticity of host '192.168.3.66 (192.168.3.66)' can't be established.
  3. RSA key fingerprint is 79:96:b8:4b:cc:74:35:71:1b:a4:0a:80:3d:3e:7b:e7.
  4. Are you sure you want to continue connecting (yes/no)? no
  5. Host key verification failed.

(I input 'no' just for test purpose.)

If I have many clients, I have to do such modify on everyone of them, so this way is not so good.

I read many documents and found this issue maybe could be fixed by enabled more Key Exchange Algorithms on the ssh server.

From the man page of ssh_config on the AIX clients:

  1.           KexAlgorithms
  2.                Specifies the available KEX (Key Exchange) algorithms.
  3.                Multiple algorithms must be comma-separated.  The
  4. 	       default is:
  5.  
  6.                ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,
  7.                diffie-hellman-group-exchange-sha256,
  8.                diffie-hellman-group-exchange-sha1,
  9.                diffie-hellman-group14-sha1,
  10.                diffie-hellman-group1-sha1

While on the server:

  1.      KexAlgorithms
  2.              Specifies the available KEX (Key Exchange) algorithms.  Multiple algorithms must be comma-separated.  The default is
  3.              “diffie-hellman-group-exchange-sha256”, “diffie-hellman-group-exchange-sha1”, “diffie-hellman-group14-sha1”,
  4.              “diffie-hellman-group1-sha1”.

The version of the ssh server is 5.3, so it should be able to support ECDH key exchange method, and I learned how to do it from the KDB on the RedHat:

How to use ECDSA and ECDH with openssh on Red Hat Enterprise Linux 6?

The steps were not complicate:

  1. [root@------ ssh]# ssh-keygen -t ecdsa -b 384 -f /etc/ssh/ssh_host_ecdsa_key
  2. Generating public/private ecdsa key pair.
  3. Enter passphrase (empty for no passphrase):
  4. Enter same passphrase again:
  5. Your identification has been saved in /etc/ssh/ssh_host_ecdsa_key.
  6. Your public key has been saved in /etc/ssh/ssh_host_ecdsa_key.pub.
  7. The key fingerprint is:
  8. 0d:10:6b:37:ef:ea:71:0d:48:62:06:9f:0b:b5:c6:6e root@------
  9. The key's randomart image is:
  10. +--[ECDSA  384]---+
  11. |    . +.         |
  12. |     = =         |
  13. |    . % =        |
  14. |     B = *       |
  15. |      E S +      |
  16. |     .   . o     |
  17. |        . o .    |
  18. |         +       |
  19. |       .o        |
  20. +-----------------+
  21. [root@------ ssh]# ssh-keygen -y -f ./ssh_host_ecdsa_key
  22. ecdsa-sha2-nistp384 AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBMdMOt813mc1t69195qvFQUAK2CdM9ImXwnfHxiOuC4dDOBmtJ/vqGXPlssuC25VUVAx/lXsk1hYInqmMJD0SNdEyUTPpcpXknhZS37LtoRwdOXDTVJ9HHpI/2b4yeJKdw==
  23. [root@------ ssh]# chmod 640 /etc/ssh/ssh_host_ecdsa_key
  24. [root@------ ssh]# chmod 640 /etc/ssh/ssh_host_ecdsa_key.pub
  25. [root@------ ssh]# chcon -t sshd_key_t /etc/ssh/ssh_host_ecdsa_key*
  26. chcon: can't apply partial context to unlabeled file `/etc/ssh/ssh_host_ecdsa_key'
  27. chcon: can't apply partial context to unlabeled file `/etc/ssh/ssh_host_ecdsa_key.pub'

Then made a backup of /etc/ssh/sshd_config and added below line to it:

  1.  KexAlgorithms ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1

We could confirm this change:

  1. [root@------ ssh]# diff sshd_config.bak sshd_config
  2. 138a139,140
  3. >
  4. > KexAlgorithms ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
  5. [root@------ ssh]# service sshd restart
  6. Stopping sshd:                                             [  OK  ]
  7. Starting sshd:                                             [  OK  ]

Then connected it from the client:

  1. ------@------:/home/------/.ssh$ssh 192.168.3.66
  2. The authenticity of host '192.168.3.66 (192.168.3.66)' can't be established.
  3. RSA key fingerprint is 79:96:b8:4b:cc:74:35:71:1b:a4:0a:80:3d:3e:7b:e7.
  4. Are you sure you want to continue connecting (yes/no)? yes
  5. Warning: Permanently added '192.168.3.66' (RSA) to the list of known hosts.
  6. ------@192.168.3.66's password:
  7. Last login: Fri Mar 23 22:08:56 2018 from 192.168.1.43
  8.  
  9. ***   Access to and use of this system is strictly restricted    ***
  10. ***             to explicitly authorized persons.                ***
  11. ***     Any violation is prohibited and will be prosecuted.      ***

So it did work. fatal: DH_GEX_REQUEST, bad parameters: 2048 !< 1024 !< 8192

 
  • 本文由 NeilZhang 发表于24/03/2018 03:53:39
  • Repost please keep this link: https://www.dbcloudsvc.com/blogs/linux/fatal-dh_gex_request-bad-parameters-2048-1024-8192/
Install Docker CE on Oracle Linux 7

加载中...

匿名

发表评论

匿名网友
:?: :razz: :sad: :evil: :!: :smile: :oops: :grin: :eek: :shock: :???: :cool: :lol: :mad: :twisted: :roll: :wink: :idea: :arrow: :neutral: :cry: :mrgreen:
确定