首页 文章

如何启用diffie-hellman-group-exchange-sha1作为Twisted Python框架中的密钥交换类型(Kippo HoneyPot Related)?

提问于
浏览
1

我有一个SSH客户端应用程序,它支持以下关键算法进行协商 .

diffie-hellman-group-exchange-sha1 diffie-hellman-group14-sha1 diffie-hellman-group-exchange-sha256

我没有更改SSH客户端的选项,因此我尝试在SSH服务器上解决问题,该服务器正在使用Twisted . SSH服务器实际上是在Kippo Honeypot中实现的,但潜在的问题是Twisted .

我看到Twisted在第221行支持diffie-hellman-group-exchange-sha1和diffie-hellman-group1-sha1:https://github.com/twisted/twisted/blob/38421d6fcffa1ddb590e51df0e1c6cba6f29d052/twisted/conch/ssh/transport.py

我看到第60行正在禁用diffie-hellman-group-exchange-sha1:https://github.com/twisted/twisted/blob/38421d6fcffa1ddb590e51df0e1c6cba6f29d052/twisted/conch/ssh/factory.py

diffie-hellman-group-exchange-sha1支持但后来被禁用 . 我的应用程序的SSH客户端无法协商密钥以 Build 与使用Twisted的SSH服务器的SSH连接 .

我在禁用它之前在代码中看到了这个注释“log.msg('禁用diffie-hellman-group-exchange因为我们找不到moduli文件')”如果我试图强制Twisted使用diffie-hellman-group-exchange- sha1我收到以下错误 .

Traceback (most recent call last):
      File "/usr/lib/python2.7/dist-packages/twisted/python/log.py", line 84, in callWithLogger
        return callWithContext({"system": lp}, func, *args, **kw)
      File "/usr/lib/python2.7/dist-packages/twisted/python/log.py", line 69, in callWithContext
        return context.call({ILogContext: newCtx}, func, *args, **kw)
      File "/usr/lib/python2.7/dist-packages/twisted/python/context.py", line 118, in callWithContext
        return self.currentContext().callWithContext(ctx, func, *args, **kw)
      File "/usr/lib/python2.7/dist-packages/twisted/python/context.py", line 81, in callWithContext
        return func(*args,**kw)
    --- <exception caught here> ---
      File "/usr/lib/python2.7/dist-packages/twisted/internet/posixbase.py", line 586, in _doReadOrWrite
        why = selectable.doRead()
      File "/usr/lib/python2.7/dist-packages/twisted/internet/tcp.py", line 199, in doRead
        rval = self.protocol.dataReceived(data)
      File "/home/sudopwn/kippo-master/kippo/core/ssh.py", line 150, in dataReceived
        transport.SSHServerTransport.dataReceived(self, data)
      File "/usr/lib/python2.7/dist-packages/twisted/conch/ssh/transport.py", line 438, in dataReceived
        self.dispatchMessage(messageNum, packet[1:])
      File "/usr/lib/python2.7/dist-packages/twisted/conch/ssh/transport.py", line 453, in dispatchMessage
        f(payload)
      File "/usr/lib/python2.7/dist-packages/twisted/conch/ssh/transport.py", line 950, in ssh_KEX_DH_GEX_REQUEST
        self.g, self.p = self.factory.getDHPrime(ideal)
      File "/usr/lib/python2.7/dist-packages/twisted/conch/ssh/factory.py", line 126, in getDHPrime
        primesKeys = self.primes.keys()
    exceptions.AttributeError: 'NoneType' object has no attribute ‘keys'

是否有解决方法或解决方案允许启用diffie-hellman-group-exchange-sha1?

1 回答

  • 1

    DH密钥交换需要模数这一事实没有"workaround" . 这就是数学的工作原理 . 如果你查看 openssh_compat.py ,你会看到 getPrimes 有一个解析器用于openssh的素数格式,如果你在 /path/to/moduli 有模数,那么 twistd -n conch --data=/path/to 将解析它们 . 您可以使用 ssh-keygen -G 生成这些 . 你需要在 HoneyPotSSHFactory 上实现类似的东西,在这里实现:https://github.com/desaster/kippo/blob/master/kippo/core/ssh.py#L53

    请记住,生成模数需要一段时间,因此您需要提前完成 .

相关问题