我有一个SSH客户端应用程序,它支持以下关键算法进行协商 .
diffie-hellman-group-exchange-sha1 diffie-hellman-group14-sha1 diffie-hellman-group-exchange-sha256
我没有更改SSH客户端的选项,因此我尝试在SSH服务器上解决问题,该服务器正在使用Twisted . SSH服务器实际上是在Kippo Honeypot中实现的,但潜在的问题是Twisted .
我看到Twisted在第221行支持diffie-hellman-group-exchange-sha1和diffie-hellman-group1-sha1:https://github.com/twisted/twisted/blob/38421d6fcffa1ddb590e51df0e1c6cba6f29d052/twisted/conch/ssh/transport.py
我看到第60行正在禁用diffie-hellman-group-exchange-sha1:https://github.com/twisted/twisted/blob/38421d6fcffa1ddb590e51df0e1c6cba6f29d052/twisted/conch/ssh/factory.py
diffie-hellman-group-exchange-sha1支持但后来被禁用 . 我的应用程序的SSH客户端无法协商密钥以 Build 与使用Twisted的SSH服务器的SSH连接 .
我在禁用它之前在代码中看到了这个注释“log.msg('禁用diffie-hellman-group-exchange因为我们找不到moduli文件')”如果我试图强制Twisted使用diffie-hellman-group-exchange- sha1我收到以下错误 .
Traceback (most recent call last):
File "/usr/lib/python2.7/dist-packages/twisted/python/log.py", line 84, in callWithLogger
return callWithContext({"system": lp}, func, *args, **kw)
File "/usr/lib/python2.7/dist-packages/twisted/python/log.py", line 69, in callWithContext
return context.call({ILogContext: newCtx}, func, *args, **kw)
File "/usr/lib/python2.7/dist-packages/twisted/python/context.py", line 118, in callWithContext
return self.currentContext().callWithContext(ctx, func, *args, **kw)
File "/usr/lib/python2.7/dist-packages/twisted/python/context.py", line 81, in callWithContext
return func(*args,**kw)
--- <exception caught here> ---
File "/usr/lib/python2.7/dist-packages/twisted/internet/posixbase.py", line 586, in _doReadOrWrite
why = selectable.doRead()
File "/usr/lib/python2.7/dist-packages/twisted/internet/tcp.py", line 199, in doRead
rval = self.protocol.dataReceived(data)
File "/home/sudopwn/kippo-master/kippo/core/ssh.py", line 150, in dataReceived
transport.SSHServerTransport.dataReceived(self, data)
File "/usr/lib/python2.7/dist-packages/twisted/conch/ssh/transport.py", line 438, in dataReceived
self.dispatchMessage(messageNum, packet[1:])
File "/usr/lib/python2.7/dist-packages/twisted/conch/ssh/transport.py", line 453, in dispatchMessage
f(payload)
File "/usr/lib/python2.7/dist-packages/twisted/conch/ssh/transport.py", line 950, in ssh_KEX_DH_GEX_REQUEST
self.g, self.p = self.factory.getDHPrime(ideal)
File "/usr/lib/python2.7/dist-packages/twisted/conch/ssh/factory.py", line 126, in getDHPrime
primesKeys = self.primes.keys()
exceptions.AttributeError: 'NoneType' object has no attribute ‘keys'
是否有解决方法或解决方案允许启用diffie-hellman-group-exchange-sha1?
1 回答
DH密钥交换需要模数这一事实没有"workaround" . 这就是数学的工作原理 . 如果你查看
openssh_compat.py
,你会看到getPrimes
有一个解析器用于openssh的素数格式,如果你在/path/to/moduli
有模数,那么twistd -n conch --data=/path/to
将解析它们 . 您可以使用ssh-keygen -G
生成这些 . 你需要在HoneyPotSSHFactory
上实现类似的东西,在这里实现:https://github.com/desaster/kippo/blob/master/kippo/core/ssh.py#L53请记住,生成模数需要一段时间,因此您需要提前完成 .