Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

x/crypto/ssh: "ssh: handshake failed: EOF" with 3des-cbc #32075

Open
eikenb opened this issue May 16, 2019 · 5 comments
Open

x/crypto/ssh: "ssh: handshake failed: EOF" with 3des-cbc #32075

eikenb opened this issue May 16, 2019 · 5 comments

Comments

@eikenb
Copy link

@eikenb eikenb commented May 16, 2019

What version of Go are you using (go version)?

$ go version
go version go1.12.5 linux/amd64

Does this issue reproduce with the latest release?

Yes.

What operating system and processor architecture are you using (go env)?

go env Output
$ go env
GOARCH="amd64"
GOBIN="/home/jae/.local/bin"
GOCACHE="/home/jae/.cache/go-build"
GOEXE=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="linux"
GOOS="linux"
GOPATH="/home/jae/projects/go/golib:/home/jae/projects/go/gotools:/home/jae/projects/go/mylib"
GOPROXY=""
GORACE=""
GOROOT="/home/jae/projects/go/goroot"
GOTMPDIR=""
GOTOOLDIR="/home/jae/projects/go/goroot/pkg/tool/linux_amd64"
GCCGO="/usr/bin/gccgo"
CC="gcc"
CXX="g++"
CGO_ENABLED="1"
GOMOD="/home/jae/notes/developement/programming/go/examples/misc-tests/go.mod"
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build225295978=/tmp/go-build -gno-record-gcc-switches"

What did you do?

I help maintain the github.com/pkg/sftp library and am helping a user with an ssh issue. They have an SFTP server that only supports some older ciphers, like 3des-cbc and they can't connect successfully. I've tried to simplify and reproduce their issue with some success. I've configured my local openssh server to only accept that cipher, with Ciphers 3des-cbc in the sshd_config and was able to connect to it with the openssh client with ssh -c 3des-cbc localhost. If I don't specify -c 3des-cbc on the command line it won't connect with a negotiation error. So everything seems good on that side.

I then try to connect with a simple program using x/crypto/ssh set to use that same cipher and get the error ssh: handshake failed: EOF and the openssh server spits out the following in the log.

May 15 20:41:26 XXX sshd[12686]: Bad packet length 1474871687. [preauth]
May 15 20:41:26 XXX sshd[12686]: ssh_dispatch_run_fatal: Connection from 127.0.0.1 port 53234: Connection corrupted [preauth]

My simple program to reproduce is..

package main

import (
	"fmt"
	"net"
	"os"

	"golang.org/x/crypto/ssh"
	"golang.org/x/crypto/ssh/agent"
)

func main() {
	sshagent, err := net.Dial("unix", os.Getenv("SSH_AUTH_SOCK"))
	if err != nil {
		panic(err)
	}
	signer := ssh.PublicKeysCallback(agent.NewClient(sshagent).Signers)

	sshConfig := &ssh.ClientConfig{
		User:            os.ExpandEnv("$USER"),
		Auth:            []ssh.AuthMethod{signer},
		HostKeyCallback: ssh.InsecureIgnoreHostKey(),
	}
	sshConfig.SetDefaults()
	sshConfig.Ciphers = []string{"3des-cbc"}

	_, err = ssh.Dial("tcp", "localhost:22", sshConfig)
	fmt.Printf("%v\n", err)
}

What did you expect to see?

No error and have it connect.

What did you see instead?

ssh: handshake failed: EOF

Thanks.

@FiloSottile
Copy link
Member

@FiloSottile FiloSottile commented May 17, 2019

/cc @hanwen

@manhquyet-nguyen
Copy link

@manhquyet-nguyen manhquyet-nguyen commented Jun 12, 2019

Any update on this issue? I got the same problem.
Connect from terminal is OK but failed via ssh.
The server ssh version is SSH-2.0-OpenSSH_6.2

@hanwen
Copy link
Contributor

@hanwen hanwen commented Jun 17, 2019

I've been on hoidays. I'll try to have a look one of these weeks.

@manhquyet-nguyen
Copy link

@manhquyet-nguyen manhquyet-nguyen commented Jun 20, 2019

I've debugged.
Server accept: [aes128-ctr aes192-ctr aes256-ctr arcfour256 arcfour128 aes128-gcm@openssh.com aes256-gcm@openssh.com aes128-cbc 3des-cbc blowfish-cbc cast128-cbc aes192-cbc aes256-cbc arcfour rijndael-cbc@lysator.liu.se]
Working algorithm are: [aes128-ctr aes192-ctr aes256-ctr arcfour256 arcfour128 arcfour]
The other cause the ssh failed with EOF error

@eikenb
Copy link
Author

@eikenb eikenb commented Dec 30, 2019

@hanwen

I had another user file a bug about this. I don't want to nag as I know how hard it can be to find time to work on things but I just wanted to ping the issue again to help it stay on the radar. Thanks.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Linked pull requests

Successfully merging a pull request may close this issue.

None yet
5 participants
You can’t perform that action at this time.