ssh2

[Bill Davidsen]

roland wrote:
> On Sat, 20 Sep 2008 01:06:10 +0200, Bill Davidsen <davidsen at tmr.com> wrote:
> 
>> roland wrote:
>>
>>> Waw, this is a very exhaustive answer, and I thank you very much for 
>>> this.
>>>  How will have to do some reading.
>>> One thing is for sure, I find the known-hosts in de userdir on 
>>> windows but there are no entries added and I do not find anywhere the 
>>> dsa or rsa or whatever keys.
>>>  I removed all the keys in /etc/ssh/ and
>>> indeed the keys were recreated.
>>>
>> Yes, that is the original problem, the host keys changed.
>>
>>> But Anita continues this difficulty and Putty never did.
>>
>> Anita has no "problem," it is warning you that the host has changed. 
>> Trying to stop the warning instead of fixing the problem is like 
>> taking the battery out of the smoke alarm instead of finding the fire!
>>
>>> Must have to do something with this 3DES.
>>>
>> It has to do with the system being hacked.
>>
>>> I don't understand how Putty can login because there aren't any 
>>> entries in known_hosts under windows which are referring to the hosts 
>>> I'm logging into. ???
>>>
>> That's why putty can't detect that there's a problem, because it 
>> doesn't have the *correct* values, and so doesn't know that there is 
>> now an incorrect host key machine at the end of the socket.
> 
> Putty is using ssh2. So if the key of the remote host is not found in 
> known_hosts on the mswindow station, why does nobody complaints? When 
> will the key of the remote host be added in this file known_hosts?
> 
Putty uses the ssh2 protocol, but probably not the code (haven't looked). In any 
case, the key is added in the Fedora ssh program after asking if you trust the 
connection (and verify the fingerprint). Without going back and checking to see 
how putty does this (haven't use putty in several years) I can't say how it 
works. I think I recall doing a manual step to save the key, but I haven't 
needed putty since 25 months now.

The use of known_hosts is done by the client, the protocol allows checking.

> following this doc here after your assumption is not correct, or do I 
> understand something wrong?
> 
What you describe below is the behavior of ssh as provided by Fedora, and that's 
based on OpenSSH from the OpenBSD project. This is their client's warning.

> If you reinstall, the reinstalled system creates a new set of 
> identification keys. Any clients who had connected to the system with 
> any of the OpenSSH tools before the reinstall will see the following 
> message:
> @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
> @    WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!     @
> @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
> IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
> Someone could be eavesdropping on you right now (man-in-the-middle attack)!
> It is also possible that the RSA host key has just been changed.

The worrying thing is that since the sshd now asks for ssh2 protocol only, there 
is a new sshd operating, one you didn't install, and one which may be copying 
keystroke data (login names and passwords) to some unauthorized other site. I 
can't say that's happening, but this has all of the characteristics of that. It 
could also be caused by an upgrade of sshd, although I read your posts to say 
that only you could do that.

It would be useful to use 'ps' to see which sshd is running, and to do an 'ls 
-l' and md5sum on the executable and post the values here. Also a telnet to the 
ssh port usually gives the protocol and sshd version, although that can be 
faked. Post that if you wish.
> 
> Roland
> 


-- 
Bill Davidsen <davidsen at tmr.com>
   "We have more to fear from the bungling of the incompetent than from
the machinations of the wicked."  - from Slashdot