Urgent: no ssh possible since net-misc/openssh-7.1_p1-r2

UncleVan · n00b Joined: 08 Feb 2011 Posts: 72

Hello everybody ,

After recent update

NeddySeagoon · Posted: Fri Nov 06, 2015 9:54 pm Post subject:

UncleVan,

net-misc/openssh-7.x depreciates one sort of key as its no longer considered secure.
You can enable if if you want but it will go away one day.

See the news item 2015-08-13 OpenSSH 7.0 disables ssh-dss keys by default

Password logins for root are also disabled by default.

UncleVan · n00b Joined: 08 Feb 2011 Posts: 72

Thank you for th quick response !

So far its fine but: How am I supposed to set up "new" keys for use ?

It is a local segment only - apart from internet - so login as root would not be an issue... BTW that was literally the same statement forcing me to not use telnet anymore ;-)

Tony0945 · Posted: Fri Nov 06, 2015 11:54 pm Post subject:

Had the same problem with root login. I did NOT change the conf file. Kept rejecting the password. I could log in as "guest" and su with the password but log in directly. I only ssh for admin work like emerge's and kernel builds, so that's a PITA.

I wound up blocking 7.0 and above like you.

Ant P. · Watchman Joined: 18 Apr 2009 Posts: 6920

New keys:

UncleVan · n00b Joined: 08 Feb 2011 Posts: 72

Thank you guys,

I'll try to set up ssh 7 for root logins and report the results.

Moriah · Posted: Sat Nov 07, 2015 3:39 pm Post subject:

Forcing this on people who have a bunch of machines to administer without even a "news readme" notice at the time the force is made is presumptuous to the point of arragonce! :evil:

I started a bunch of weekly updates last night and went to bed while they ran. I woke up this morning to chaos! I have many automation scripts that log in from one machine to another to perform various operations, not the least of which is nightly backups. Everything is broken! I kept all the old sshd config files, so why did everything change? Because some nanny of a developer decided that they knew bettter than I what was good for my network! :evil:

Only 2 of these machines is internet facing, yet all of them have been affected by this gentoo induced denial of service attack! :evil:

I was going to clean the fallen leaves out of the yard today, but know I have a broken network to fix instead.

(Maybe that's a good thing?)

_________________
The MyWord KJV Bible tool is at http://www.elilabs.com/~myword

Foghorn Leghorn is a Warner Bros. cartoon character.

UncleVan · n00b Joined: 08 Feb 2011 Posts: 72

OK, pretty trivial (shame on me .....): Just add/change in /etc/ssh/sshd_config

krinn · Watchman Joined: 02 May 2003 Posts: 7470

Moriah · Posted: Sat Nov 07, 2015 4:35 pm Post subject:

Pleaase note the phrase at the time the force .

I did not say therre was not a news item on it; I said there ought to be a "re-reminder" at the time it was actually happening.
_________________
The MyWord KJV Bible tool is at http://www.elilabs.com/~myword

Foghorn Leghorn is a Warner Bros. cartoon character.

ct85711 · Veteran Joined: 27 Sep 2005 Posts: 1791

that's the thing, there was a reminder... we can't force you to read it

Moriah · Posted: Sat Nov 07, 2015 5:35 pm Post subject:

That was my complaint: the reminder ws 2 months before the occurrance. I read it, but after 2 months, it would have been nice to announce that it was going into effect today.
_________________
The MyWord KJV Bible tool is at http://www.elilabs.com/~myword

Foghorn Leghorn is a Warner Bros. cartoon character.

Moriah · Posted: Sat Nov 07, 2015 5:41 pm Post subject:

Anyway, I am taking advantage of this inconvenient event to clear out all my stuff in my .ssh/ directories and regenerate it to the new standards. One thing I *will* keep is root login via password. I have some utility machines that have no other user besides root. I am the only administrator. I only administrate these machines because there is no one else to do it, and I need them to do myincome producing work. As I said, there are only 2 of them that are internet facing; the rest are on a well protected ethernet segment behind multiple natting firewalls. From time to time, they all need to be administered remotely, possibly from machines that have never logged into those machines before. Therefore, I need to allow root login via password on ssh.

Also, I a, *not* clearing the fallen leaves out of the yard today!

_________________
The MyWord KJV Bible tool is at http://www.elilabs.com/~myword

Foghorn Leghorn is a Warner Bros. cartoon character.

NeddySeagoon · Posted: Sat Nov 07, 2015 5:45 pm Post subject:

Moriah,

Moriah · Posted: Sat Nov 07, 2015 6:18 pm Post subject:

Neddy:

I also have to run a lot of scripts that login as root. Finding and changing them all would be a major pain tht I just do not have time for right now.
_________________
The MyWord KJV Bible tool is at http://www.elilabs.com/~myword

Foghorn Leghorn is a Warner Bros. cartoon character.

The LT · Posted: Sun Nov 08, 2015 2:55 pm Post subject:

ct85711 · Veteran Joined: 27 Sep 2005 Posts: 1791

iirc, the login with root has been defaulted to commented out for several years to begin with, so that change isn't anything new. Now if upstream is starting to phase out that option all together, I couldn't say. I can see arguments for both sides, and I admit I used the login with root before. Though that is only when I am setting up a new machine, once the machine is up, I leave it turned off and just login with a regular user, then su into root.

Tony0945 · Posted: Sun Nov 08, 2015 6:39 pm Post subject:

UberLord · Posted: Mon Nov 09, 2015 9:54 am Post subject:

Moriah · Posted: Thu Dec 10, 2015 1:49 pm Post subject:

Neddy helped me solve this problem thru a series of private messages. Thanks, Neddy!
_________________
The MyWord KJV Bible tool is at http://www.elilabs.com/~myword

Foghorn Leghorn is a Warner Bros. cartoon character.