1 |
On 11/14/2015 02:22 PM, Neil Bothwick wrote: |
2 |
> On Sat, 14 Nov 2015 08:54:38 -0700, thelma@×××××××××××.com wrote: |
3 |
> |
4 |
>> The only software that uses ssh-dss key and I need is nxserver. |
5 |
>> |
6 |
>> I just added a line to my: sshd_config |
7 |
>> PubkeyAcceptedKeyTypes=+ssh-dss |
8 |
> |
9 |
> You should add this to a Host section, so it only enables the wek |
10 |
> encryption for that host. |
11 |
> |
12 |
>> restarted "sshd and nxserver" but I nxserver still doesn't work, |
13 |
>> running: nxsetup --test (I get): |
14 |
>> |
15 |
>> ----> Testing your nxserver connection ... |
16 |
>> Permission denied (publickey,password,keyboard-interactive). |
17 |
>> Fatal error: Could not connect to NX Server. |
18 |
> |
19 |
> That doesn't look like the error you get from an unsupported key, which |
20 |
> is something like |
21 |
> |
22 |
> Unable to negotiate with x.x.x.x: no matching host key type found. Their offer: ssh-dss |
23 |
> |
24 |
> Is nxserver trying to connect as root? It looks more like the disabling |
25 |
> of passworded root logins in OpenSSH. |
26 |
|
27 |
|
28 |
|
29 |
Here is my sshd_config: (nxserver works with openssh-6.9_p1-r2) |
30 |
As soon as I upgrade to openssh-7, enable: |
31 |
PubkeyAcceptedKeyTypes=+ssh-dss |
32 |
|
33 |
restart: sshd |
34 |
and nxserver gives me an error message (like above). |
35 |
|
36 |
Yes, I'm running "nxsetup --test" as root. |
37 |
|
38 |
# $OpenBSD: sshd_config,v 1.95 2015/04/27 21:42:48 djm Exp $ |
39 |
|
40 |
# This is the sshd server system-wide configuration file. See |
41 |
# sshd_config(5) for more information. |
42 |
|
43 |
# This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin |
44 |
|
45 |
# The strategy used for options in the default sshd_config shipped with |
46 |
# OpenSSH is to specify options with their default value where |
47 |
# possible, but leave them commented. Uncommented options override the |
48 |
# default value. |
49 |
|
50 |
#Port 22 |
51 |
#AddressFamily any |
52 |
#ListenAddress 0.0.0.0 |
53 |
#ListenAddress :: |
54 |
|
55 |
# The default requires explicit activation of protocol 1 |
56 |
#Protocol 2 |
57 |
|
58 |
# HostKey for protocol version 1 |
59 |
#HostKey /etc/ssh/ssh_host_key |
60 |
# HostKeys for protocol version 2 |
61 |
#HostKey /etc/ssh/ssh_host_rsa_key |
62 |
#HostKey /etc/ssh/ssh_host_dsa_key |
63 |
#HostKey /etc/ssh/ssh_host_ecdsa_key |
64 |
#HostKey /etc/ssh/ssh_host_ed25519_key |
65 |
|
66 |
# Lifetime and size of ephemeral version 1 server key |
67 |
#KeyRegenerationInterval 1h |
68 |
#ServerKeyBits 1024 |
69 |
|
70 |
# Ciphers and keying |
71 |
#RekeyLimit default none |
72 |
|
73 |
# Logging |
74 |
# obsoletes QuietMode and FascistLogging |
75 |
#SyslogFacility AUTH |
76 |
#LogLevel INFO |
77 |
|
78 |
# Authentication: |
79 |
|
80 |
#LoginGraceTime 2m |
81 |
#PermitRootLogin no |
82 |
#StrictModes yes |
83 |
#MaxAuthTries 6 |
84 |
#MaxSessions 10 |
85 |
|
86 |
#RSAAuthentication yes |
87 |
#PubkeyAuthentication yes |
88 |
|
89 |
# The default is to check both .ssh/authorized_keys and |
90 |
.ssh/authorized_keys2 |
91 |
# but this is overridden so installations will only check |
92 |
.ssh/authorized_keys |
93 |
#AuthorizedKeysFile .ssh/authorized_keys |
94 |
|
95 |
# Added Nov 14/15, needed for nxserver to work |
96 |
# PubkeyAcceptedKeyTypes=+ssh-dss |
97 |
|
98 |
#AuthorizedPrincipalsFile none |
99 |
|
100 |
#AuthorizedKeysCommand none |
101 |
#AuthorizedKeysCommandUser nobody |
102 |
|
103 |
# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts |
104 |
#RhostsRSAAuthentication no |
105 |
# similar for protocol version 2 |
106 |
#HostbasedAuthentication no |
107 |
# Change to yes if you don't trust ~/.ssh/known_hosts for |
108 |
# RhostsRSAAuthentication and HostbasedAuthentication |
109 |
#IgnoreUserKnownHosts no |
110 |
# Don't read the user's ~/.rhosts and ~/.shosts files |
111 |
#IgnoreRhosts yes |
112 |
|
113 |
# To disable tunneled clear text passwords, change to no here! |
114 |
PasswordAuthentication yes |
115 |
#PermitEmptyPasswords no |
116 |
|
117 |
# Change to no to disable s/key passwords |
118 |
#ChallengeResponseAuthentication yes |
119 |
|
120 |
# Kerberos options |
121 |
#KerberosAuthentication no |
122 |
#KerberosOrLocalPasswd yes |
123 |
#KerberosTicketCleanup yes |
124 |
#KerberosGetAFSToken no |
125 |
|
126 |
# GSSAPI options |
127 |
#GSSAPIAuthentication no |
128 |
#GSSAPICleanupCredentials yes |
129 |
|
130 |
# Set this to 'yes' to enable PAM authentication, account processing, |
131 |
# and session processing. If this is enabled, PAM authentication will |
132 |
# be allowed through the ChallengeResponseAuthentication and |
133 |
# PasswordAuthentication. Depending on your PAM configuration, |
134 |
# PAM authentication via ChallengeResponseAuthentication may bypass |
135 |
# the setting of "PermitRootLogin without-password". |
136 |
# If you just want the PAM account and session checks to run without |
137 |
# PAM authentication, then enable this but set PasswordAuthentication |
138 |
# and ChallengeResponseAuthentication to 'no'. |
139 |
UsePAM yes |
140 |
|
141 |
#AllowAgentForwarding yes |
142 |
#AllowTcpForwarding yes |
143 |
#GatewayPorts no |
144 |
X11Forwarding yes |
145 |
#X11DisplayOffset 10 |
146 |
#X11UseLocalhost yes |
147 |
#PermitTTY yes |
148 |
PrintMotd no |
149 |
PrintLastLog no |
150 |
#TCPKeepAlive yes |
151 |
#UseLogin no |
152 |
UsePrivilegeSeparation sandbox # Default for new installations. |
153 |
#PermitUserEnvironment no |
154 |
#Compression delayed |
155 |
#ClientAliveInterval 0 |
156 |
#ClientAliveCountMax 3 |
157 |
#UseDNS no |
158 |
#PidFile /run/sshd.pid |
159 |
#MaxStartups 10:30:100 |
160 |
#PermitTunnel no |
161 |
#ChrootDirectory none |
162 |
#VersionAddendum none |
163 |
|
164 |
# no default banner path |
165 |
#Banner none |
166 |
|
167 |
# here are the new patched ldap related tokens |
168 |
# entries in your LDAP must have posixAccount & ldapPublicKey objectclass |
169 |
#UseLPK yes |
170 |
#LpkLdapConf /etc/ldap.conf |
171 |
#LpkServers ldap://10.1.7.1/ ldap://10.1.7.2/ |
172 |
#LpkUserDN ou=users,dc=phear,dc=org |
173 |
#LpkGroupDN ou=groups,dc=phear,dc=org |
174 |
#LpkBindDN cn=Manager,dc=phear,dc=org |
175 |
#LpkBindPw secret |
176 |
#LpkServerGroup mail |
177 |
#LpkFilter (hostAccess=master.phear.org) |
178 |
#LpkForceTLS no |
179 |
#LpkSearchTimelimit 3 |
180 |
#LpkBindTimelimit 3 |
181 |
#LpkPubKeyAttr sshPublicKey |
182 |
|
183 |
# override default of no subsystems |
184 |
Subsystem sftp /usr/lib64/misc/sftp-server |
185 |
|
186 |
# the following are HPN related configuration options |
187 |
# tcp receive buffer polling. disable in non autotuning kernels |
188 |
#TcpRcvBufPoll yes |
189 |
|
190 |
# disable hpn performance boosts |
191 |
#HPNDisabled no |
192 |
|
193 |
# buffer size for hpn to non-hpn connections |
194 |
#HPNBufferSize 2048 |
195 |
|
196 |
|
197 |
# allow the use of the none cipher |
198 |
#NoneEnabled no |
199 |
|
200 |
# Example of overriding settings on a per-user basis |
201 |
#Match User anoncvs |
202 |
# X11Forwarding no |
203 |
# AllowTcpForwarding no |
204 |
# PermitTTY no |
205 |
# ForceCommand cvs server |
206 |
|
207 |
# Allow client to pass locale environment variables #367017 |
208 |
AcceptEnv LANG LC_* |
209 |
|
210 |
-- |
211 |
Thelma |