Debian Bug report logs - #726579
Missing IP address in log "fatal: no hostkey alg"

version graph

Package: openssh-server; Maintainer for openssh-server is Debian OpenSSH Maintainers <debian-ssh@lists.debian.org>; Source for openssh-server is src:openssh (PTS, buildd, popcon).

Reported by: Karl Schmidt <karl@xtronics.com>

Date: Wed, 16 Oct 2013 20:09:02 UTC

Severity: normal

Found in version openssh/1:6.0p1-4

Reply or subscribe to this bug.

Toggle useless messages

View this report as an mbox folder, status mbox, maintainer mbox


Report forwarded to debian-bugs-dist@lists.debian.org, Debian OpenSSH Maintainers <debian-ssh@lists.debian.org>:
Bug#726579; Package openssh-server. (Wed, 16 Oct 2013 20:09:06 GMT) (full text, mbox, link).


Acknowledgement sent to Karl Schmidt <karl@xtronics.com>:
New Bug report received and forwarded. Copy sent to Debian OpenSSH Maintainers <debian-ssh@lists.debian.org>. (Wed, 16 Oct 2013 20:09:06 GMT) (full text, mbox, link).


Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Karl Schmidt <karl@xtronics.com>
To: Debian Bug Tracking System <submit@bugs.debian.org>
Subject: Missing IP address in log "fatal: no hostkey alg"
Date: Wed, 16 Oct 2013 15:05:36 -0500
Package: openssh-server
Version: 1:6.0p1-4
Severity: normal

 Oct 16 06:40:58 hostname sshd[9438]: fatal: no hostkey alg [preauth]     This log entry appears to 
be recording an attempt to connect with out stating the hostkey alg,
 but the IP that is trying to connect is not logged. It should log where the connect attempt 
originates.

 System Information:
Debian Release: 7.2
  APT prefers stable
  APT policy: (990, 'stable'), (500, 'stable-updates')
Architecture: amd64 (x86_64)

Kernel: Linux 3.2.0-4-amd64 (SMP w/1 CPU core)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash

Versions of packages openssh-server depends on:
ii  adduser                3.113+nmu3
ii  debconf [debconf-2.0]  1.5.49
ii  dpkg                   1.16.12
ii  libc6                  2.13-38
ii  libcomerr2             1.42.5-1.1
ii  libgssapi-krb5-2       1.10.1+dfsg-5+deb7u1
ii  libkrb5-3              1.10.1+dfsg-5+deb7u1
ii  libpam-modules         1.1.3-7.1
ii  libpam-runtime         1.1.3-7.1
ii  libpam0g               1.1.3-7.1
ii  libselinux1            2.1.9-5
ii  libssl1.0.0            1.0.1e-2
ii  libwrap0               7.6.q-24
ii  lsb-base               4.1+Debian8+deb7u1
ii  openssh-client         1:6.0p1-4
ii  procps                 1:3.3.3-3
ii  zlib1g                 1:1.2.7.dfsg-13

Versions of packages openssh-server recommends:
ii  ncurses-term             5.9-10
ii  openssh-blacklist        0.4.1+nmu1
ii  openssh-blacklist-extra  0.4.1+nmu1
pn  xauth                    <none>

Versions of packages openssh-server suggests:
pn  molly-guard   <none>
pn  monkeysphere  <none>
pn  rssh          <none>
pn  ssh-askpass   <none>
pn  ufw           <none>

-- debconf information:
  ssh/vulnerable_host_keys:
* ssh/use_old_init_script: true
  ssh/encrypted_host_key_but_no_keygen:
  ssh/disable_cr_auth: false



Information forwarded to debian-bugs-dist@lists.debian.org, Debian OpenSSH Maintainers <debian-ssh@lists.debian.org>:
Bug#726579; Package openssh-server. (Thu, 28 Jul 2016 19:54:03 GMT) (full text, mbox, link).


Acknowledgement sent to Karl Schmidt <karl@xtronics.com>:
Extra info received and forwarded to list. Copy sent to Debian OpenSSH Maintainers <debian-ssh@lists.debian.org>. (Thu, 28 Jul 2016 19:54:03 GMT) (full text, mbox, link).


Message #10 received at 726579@bugs.debian.org (full text, mbox, reply):

From: Karl Schmidt <karl@xtronics.com>
To: 726579@bugs.debian.org
Subject: Years pass
Date: Thu, 28 Jul 2016 14:14:49 -0500
Having the IP address on the same line - with info log level is obviously needed for identifying 
attackers..


Yet still today --

From /var/log/auth.log


Jul 28 08:37:27 hostname sshd[12053]: fatal: no matching cipher found: client 
aes128-cbc,blowfish-cbc,3des-cbc server aes256-ctr,aes192-ctr,aes128-ctr [preauth]



Jul 28 08:58:38 hostname sshd[12512]: fatal: Unable to negotiate a key exchange method [preauth]


Please pass this upstream or send me a contact there..

-- 
--------------------------------------------------------------------------------

Karl Schmidt                                  EMail Karl@xtronics.com
Transtronics, Inc.                              WEB https://secure.transtronics.com
3209 West 9th Street                             Ph (785) 841-3089
Lawrence, KS 66049                              FAX (785) 841-3089

--------------------------------------------------------------------------------



Information forwarded to debian-bugs-dist@lists.debian.org, Debian OpenSSH Maintainers <debian-ssh@lists.debian.org>:
Bug#726579; Package openssh-server. (Thu, 28 Jul 2016 19:54:05 GMT) (full text, mbox, link).


Acknowledgement sent to Karl Schmidt <karl@xtronics.com>:
Extra info received and forwarded to list. Copy sent to Debian OpenSSH Maintainers <debian-ssh@lists.debian.org>. (Thu, 28 Jul 2016 19:54:05 GMT) (full text, mbox, link).


Message #15 received at 726579@bugs.debian.org (full text, mbox, reply):

From: Karl Schmidt <karl@xtronics.com>
To: 726579@bugs.debian.org
Subject: Others have noticed
Date: Thu, 28 Jul 2016 14:18:09 -0500
https://quickview.cloudapps.cisco.com/quickview/bug/CSCuv42794

-- 
--------------------------------------------------------------------------------

Karl Schmidt                                  EMail Karl@xtronics.com
Transtronics, Inc.                              WEB https://secure.transtronics.com
3209 West 9th Street                             Ph (785) 841-3089
Lawrence, KS 66049                              FAX (785) 841-3089

--------------------------------------------------------------------------------



Information forwarded to debian-bugs-dist@lists.debian.org, Debian OpenSSH Maintainers <debian-ssh@lists.debian.org>:
Bug#726579; Package openssh-server. (Mon, 01 Aug 2016 10:51:04 GMT) (full text, mbox, link).


Acknowledgement sent to Matthew Vernon <matthew@debian.org>:
Extra info received and forwarded to list. Copy sent to Debian OpenSSH Maintainers <debian-ssh@lists.debian.org>. (Mon, 01 Aug 2016 10:51:06 GMT) (full text, mbox, link).


Message #20 received at 726579@bugs.debian.org (full text, mbox, reply):

From: Matthew Vernon <matthew@debian.org>
To: Karl Schmidt <karl@xtronics.com>
Cc: 726579@bugs.debian.org
Subject: Re: Bug#726579: Years pass
Date: Mon, 01 Aug 2016 11:49:05 +0100
Karl Schmidt <karl@xtronics.com> writes:

> Please pass this upstream or send me a contact there..

The upstream development list is reachable at
openssh-unix-dev@mindrot.org - you can find information (including how
to subscribe) here:

https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev

HTH,

Matthew

-- 
"At least you know where you are with Microsoft."
"True. I just wish I'd brought a paddle."
http://www.debian.org



Information forwarded to debian-bugs-dist@lists.debian.org, Debian OpenSSH Maintainers <debian-ssh@lists.debian.org>:
Bug#726579; Package openssh-server. (Mon, 01 Aug 2016 19:27:03 GMT) (full text, mbox, link).


Acknowledgement sent to Karl Schmidt <karl@xtronics.com>:
Extra info received and forwarded to list. Copy sent to Debian OpenSSH Maintainers <debian-ssh@lists.debian.org>. (Mon, 01 Aug 2016 19:27:03 GMT) (full text, mbox, link).


Message #25 received at 726579@bugs.debian.org (full text, mbox, reply):

From: Karl Schmidt <karl@xtronics.com>
To: 726579@bugs.debian.org
Subject: Apparently fixed in the version found in testing
Date: Mon, 1 Aug 2016 14:23:09 -0500
> $ ssh -p 2022 -o kexalgorithms=diffie-hellman-group1-sha1 localhost
>
> ssh_dispatch_run_fatal: Connection to 127.0.0.1: no matching key exchange method found [preauth]
>
> $ ssh -p 2022 -o ciphers=3des-cbc localhost
>
> ssh_dispatch_run_fatal: Connection to 127.0.0.1: no matching cipher found [preauth]

There is no backport of this - nor is it in the security update ( Probably should be as it effects 
security if running fail2ban )

As it is fixed in newer versions this bug probably should be closed.

-- 
--------------------------------------------------------------------------------

Karl Schmidt                                  EMail Karl@xtronics.com
Transtronics, Inc.                              WEB https://secure.transtronics.com
3209 West 9th Street                             Ph (785) 841-3089
Lawrence, KS 66049                              FAX (785) 841-3089

"Never hire an A-student unless the job is to take exams"
Taleb
--------------------------------------------------------------------------------



Information forwarded to debian-bugs-dist@lists.debian.org, Debian OpenSSH Maintainers <debian-ssh@lists.debian.org>:
Bug#726579; Package openssh-server. (Tue, 02 Aug 2016 19:30:03 GMT) (full text, mbox, link).


Acknowledgement sent to Karl Schmidt <karl@xtronics.com>:
Extra info received and forwarded to list. Copy sent to Debian OpenSSH Maintainers <debian-ssh@lists.debian.org>. (Tue, 02 Aug 2016 19:30:03 GMT) (full text, mbox, link).


Message #30 received at 726579@bugs.debian.org (full text, mbox, reply):

From: Karl Schmidt <karl@xtronics.com>
To: 726579@bugs.debian.org
Subject: Apparently fixed in the version found in testing
Date: Tue, 2 Aug 2016 14:27:00 -0500
Fixed upstream -

https://bugzilla.mindrot.org/show_bug.cgi?id=2327


It varies depending on exactly which bit you are looking at.

Remote IP addresses: bug#2257 since at least 6.9:
https://anongit.mindrot.org/openssh.git/commit/?id=639d6bc5

Remote port numbers: bug#2503, first in 7.2
https://anongit.mindrot.org/openssh.git/commit/?id=a4b9e0f4


-- 
--------------------------------------------------------------------------------

Karl Schmidt                                  EMail Karl@xtronics.com
Transtronics, Inc.                              WEB https://secure.transtronics.com
3209 West 9th Street                             Ph (785) 841-3089
Lawrence, KS 66049                              FAX (785) 841-3089


A suit does not make one a man - nor does a degree make one educated. kps
--------------------------------------------------------------------------------



Send a report that this bug log contains spam.


Debian bug tracking system administrator <owner@bugs.debian.org>. Last modified: Sat Mar 25 18:18:24 2023; Machine Name: buxtehude

Debian Bug tracking system

Debbugs is free software and licensed under the terms of the GNU Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

Copyright © 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson, 2005-2017 Don Armstrong, and many other contributors.