HostKeyAlgorithms

Various problems with legacy SSH systems

 in Bash / GNU/Linux  tagged diffie-hellman-group1-sha1 / HostKeyAlgorithms / KexAlgorithms / ssh / ssh-dss by

Case 1

ssh [email protected];

Unable to negotiate with 192.168.1.1 port 22: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1

We solved this problem using the following command:

ssh -oKexAlgorithms=+diffie-hellman-group1-sha1 [email protected];

Case 2

ssh -oKexAlgorithms=+diffie-hellman-group1-sha1 [email protected];

Unable to negotiate with 192.168.1.1 port 22: no matching host key type found. Their offer: ssh-rsa,ssh-dss

We solved this problem using the following command:

ssh -oKexAlgorithms=+diffie-hellman-group1-sha1 -oHostKeyAlgorithms=+ssh-dss [email protected];

Unable to negotiate with IP port 22: no matching host key type found. Their offer: ssh-rsa

 in Bash / GNU/Linux  tagged bash / GNU/Linux / HostKeyAlgorithms / PubkeyAcceptedKeyTypes / ssh-rsa by

Secure Shell (SSH) is a cryptographic network protocol that is commonly used for secure data communication, remote command-line login, and other network services. The SSH command is used to remotely connect to a server or device and execute commands on that device. In this blog post, we will explain the following SSH command and when the extra parameters are needed.

ssh -p 22 -o HostKeyAlgorithms=+ssh-rsa -o PubkeyAcceptedKeyTypes=+ssh-rsa user@host;

Breakdown of the SSH command

  • ssh: The command to initiate a Secure Shell connection to a remote host.
  • -p 22: The -p option specifies the port number that SSH should use to connect to the remote host. In this case, the port number is 22, which is the default SSH port number.
  • -o HostKeyAlgorithms=+ssh-rsa: The -o option allows the user to set SSH options. In this case, the option HostKeyAlgorithms specifies the key exchange algorithm that should be used for the connection. The +ssh-rsa parameter adds the ssh-rsa algorithm to the list of acceptable algorithms.
  • -o PubkeyAcceptedKeyTypes=+ssh-rsa: Similar to the previous parameter, this option specifies the type of public key that will be accepted for authentication purposes. The +ssh-rsa parameter adds the ssh-rsa key type to the list of acceptable key types.
  • user@host: Specifies the username and hostname of the remote machine to connect to.

When are the extra parameters needed?

The extra parameters in this SSH command are used to specify the key exchange and authentication algorithms that are acceptable for the SSH connection. This is important because older, less secure algorithms can be vulnerable to attacks. By specifying only the more secure algorithms, you can help ensure that your connection is as secure as possible.

The specific parameters used in this command are not always necessary, but they can be useful in certain situations. For example, if you are connecting to an older SSH server that uses weaker encryption algorithms, you may want to specify only the stronger algorithms that are supported by both the server and your client. Similarly, if you are connecting to a server that requires a specific type of public key for authentication, you can specify that key type using the PubkeyAcceptedKeyTypes option.

In general, it’s a good idea to use the most secure algorithms that are supported by both your client and the remote server. This can help ensure that your connection is as secure as possible and minimize the risk of unauthorized access or data breaches.

In conclusion, the SSH command is a powerful tool for remotely connecting to and managing servers and devices. By understanding the different parameters and options available, you can customize your SSH connections to meet your specific needs and ensure that your connections are as secure as possible.

How to Create a Custom Local DNS Entry on a Ubiquity Dream Machine Pro

 in GNU/Linux  tagged DNS / DNS Entry / dnsmasq / Dream Machine Pro / HostKeyAlgorithms / Local DNS Entry / PubkeyAcceptedKeyTypes / ssh / ssh-rsa / Ubiquity by

DNS (Domain Name System) is an essential part of the internet infrastructure that translates domain names into IP addresses. However, you can also use DNS for internal networks to assign custom hostnames to specific IP addresses. In this post, we will discuss how to create a custom local DNS entry on a Ubiquity Dream Machine Pro.

The first step is to assign a static IP address to the machine you want to create a custom DNS entry for. To do this, log in to the Dream Machine Pro’s web interface and navigate to https://10.1.1.254/network/default/clients. Find the machine you want to assign a static IP address to and click the “Static” button. Enter the IP address you want to assign and click “Save”.

Next, you need to assign a specific hostname to the machine. However, you might run into an error message that says “An error occurred while changing your settings”. This error occurs when you use a specific domain name like “bytefreaks.lcl”. To work around this issue, you can use a different TLD like “.net” instead.

If you still want to use the “.lcl” TLD, you will need to SSH into the Dream Machine Pro to modify the configuration files. Use the following SSH command to log in as root:

ssh -p 22 -o HostKeyAlgorithms=+ssh-rsa -o PubkeyAcceptedKeyTypes=+ssh-rsa [email protected];

If the default SSH command produces an error, you can use the above custom SSH command to log in successfully.

Once you have logged in via SSH, you will need to modify the following files:

  • /run/dnsmasq.conf.d/dns.conf
  • /mnt/data/udapi-config/ubios-udapi-server/ubios-udapi-server.state

The /run/dnsmasq.conf.d/dns.conf and /mnt/data/udapi-config/ubios-udapi-server/ubios-udapi-server.state files contain information about the local DNS entries. Use the “vi” editor to modify the /run/dnsmasq.conf.d/dns.conf file and replace the “.net” TLD with the “.lcl” TLD.

After you have made the necessary changes, exit the editor and kill the dnsmasq process using the following command:

pkill dnsmasq;

This command will stop the dnsmasq process, which is responsible for the DNS resolution. Then, execute dnsmasq again to ensure that it is running properly.

Now, you should be able to view your machine using the custom “.lcl” TLD from a browser. By creating a custom local DNS entry, you can simplify your local network administration and access your devices more easily.