[solved] Cannot ssh to other hosts after openssh-7.7_p1-r4

quinn_jones · Last edited by quinn_jones on Thu Jun 21, 2018 1:31 pm; edited 1 time in total

Hi all,

I ran an "emerge -uDNav world" this morning, which upgraded openssh to 7.7_p1-r4. After the upgrade, I cannot make new connections to other hosts. The error looks like this:

khayyam · Posted: Fri Jun 15, 2018 3:40 pm Post subject:

quinn_jones ...

that just looks like the ssh-agent running was started prior to the update, and that you need to restart the session/shell/ssh-agent.

best ... khay

quinn_jones · Posted: Fri Jun 15, 2018 3:54 pm Post subject:

Hi Khay,

Thanks for the reply, but (as usual) I failed to provide all of the information. I also think you're concentrating on the wrong part of the issue.

What you didn't know, and don't see, is me logging out and rebooting while troubleshooting this myself. I did verify that the agent was stopped, until it was clear to me that it wasn't the source of the problem.

The errors started immediately after the upgrade, without a reboot. I rebooted and they persisted. Cue a series of downgrades, upgrades, and recompiles with/without the 'hpn' USE flag and some more reboots just to be sure.

I cannot explain the warning you see, "agent returned different signature type ssh-rsa (expected rsa-sha2-512)", but it doesn't seem to affect anything. I see the same warning when I log into localhost which, as mentioned, works.

I believe that the issue is with the new version of openssh, not the agent specifically.

Tony0945 · Posted: Fri Jun 15, 2018 9:13 pm Post subject:

Running the same version with, I think, the same flags. No problem. Everything seems to match expect I don't have the broken pipe. Is a firewall on either computer blocking port 22?

Hu · Administrator Joined: 06 Mar 2007 Posts: 23064

Verbosity can be increased up to level 3. OP: you ran only with level 1. Do higher levels of verbosity help? Does the server log anything interesting when it closes your connection?

toralf · Posted: Sat Jun 16, 2018 1:03 pm Post subject:

a Gentoo dev blames this : https://github.com/rapier1/openssh-portable/commit/e3ea335abeab731c68f2b2141bee85a4b0bf680f
So try to add "-hpn" to make.conf and see if it helps.

OTOH: https://dev.gnupg.org/T3880

Whissi · Retired Dev Joined: 12 Jan 2011 Posts: 222

For the agent message, please see https://dev.gnupg.org/T3880

You probably have a bad agent. See https://bugs.gentoo.org/658038 for additional details.
_________________
Regards,
Whissi

russK · l33t Joined: 27 Jun 2006 Posts: 665

One of the posts to the bugs referenced seems apropos, to skip use of the agent, ssh directly:

khayyam · Posted: Sat Jun 16, 2018 3:28 pm Post subject:

Whissi · Retired Dev Joined: 12 Jan 2011 Posts: 222

quinn_jones · Posted: Sat Jun 16, 2018 6:23 pm Post subject:

Hi all,

I may be getting closer to a solution, or maybe not a solution but an understanding. I got home and upgraded one of my computers there. The environments are similar (x86_64, MATE DE, profile v17.0, up-to-date with same-day "portage --sync" and "emerge -uDNav world") but not entirely the same software. I purposely did not upgrade the public-facing Gentoo server that I tried yesterday so I could run tests.

On my home systems I do not get dumped, i.e. openssh-7.7_p1-r4 is not a problem. That suggests that there something about the specific configuration on my work system (the one exhibiting the error).

u/Whissi: The agent warning still comes up, but connections don't fail. That behavior corresponds to your link. Thank you for the info.

u/Tony0945: thank you for the suggestion, but I'm pretty sure that a firewall isn't the issue. Downgrading (without making other changes) temporarily solves the problem.

u/Hu: When I get back to my work computer next, I will try logging in again using -vvv and see if there are server-side errors. Those are both great suggestions, thank you.

Tony0945 · Posted: Sat Jun 16, 2018 7:11 pm Post subject:

khayyam · Posted: Sat Jun 16, 2018 7:29 pm Post subject:

bunder · Bodhisattva Joined: 10 Apr 2004 Posts: 5947

I had this problem the other day on my laptop, I thought it was gnome-keyring gumming up the works, started working for me after killing it.

(why gnome-keyring for a text terminal using ssh compared to gpg, I don't know)

edit: personal opinion, but you want hpn, it makes ssh much faster for file transfers and the like.
_________________

khayyam · Posted: Sun Jun 17, 2018 5:59 am Post subject:

quinn_jones · Posted: Mon Jun 18, 2018 11:38 am Post subject:

Hi all,

Thank you for your help and input so far.

I'm back at work, on the "problem" machine, and can test some more.

To put one open question to rest: the system in question is running Gentoo. I'm connecting to a number of other platforms, but the one having issues making those connections on openssh-7.7_p1-r4 is a Gentoo system.

Here's the results of ssh -vvv:

Whissi · Retired Dev Joined: 12 Jan 2011 Posts: 222

quinn_jones · Posted: Mon Jun 18, 2018 1:00 pm Post subject:

Oops, you are correct.

Here's the diff of the two outputs; they're largely the same.

Whissi · Retired Dev Joined: 12 Jan 2011 Posts: 222

So the agent problem/warning is gone but you still have problems?

Tell us about your setup:

Are ssh client machine and ssh host machine located in same network, i.e. a LAN connection?
If no LAN, tell us more about setup/involved routers
I.e. any special device like a "Hybrid router"?
Show us your /home/me/.ssh/config
You should start with a blank config and then add something like
Code:

Host *
ServerAliveInterval 10
ServerAliveCountMax 6
for testing

_________________
Regards,
Whissi

quinn_jones · Posted: Mon Jun 18, 2018 1:47 pm Post subject:

Hi u/Whissi,

Thank you for the quick follow-ups!

Here's the answers to your questions:

I've tried ssh'ing to hosts on the local LAN and over the internet. The internet host is my home server, which is also running Gentoo but hasn't been upgraded yet. (purposefully holding off while we troubleshoot this). Other hosts are local.
I'm not at liberty to provide the LAN topology, as I'm on an enterprise-level network. I don't know the particulars and I don't feel comfortable divulging output from nmap or even traceroutes.
I am running this particular instance as a VMware guest on a Win7 host, using NAT networking. I'm not aware of any special or irregular equipment otherwise.
my ssh config is pasted below. I've redacted a long series of 'Host' and 'User' directives as they don't seem relevant and, like above, could be considered sensitive. I swear that's all that's missing, though.

Whissi · Retired Dev Joined: 12 Jan 2011 Posts: 222

We had a similar report https://bugs.gentoo.org/653960 but I cannot reproduce.
_________________
Regards,
Whissi

quinn_jones · Posted: Mon Jun 18, 2018 2:04 pm Post subject:

Huh, that sounds pretty much like my situation.

Is there more information I can provide to help reproduce?

FWIW, mine is VMware Workstation 12 Player, version 12.5.9 build-07535481. There are no pending updates. I've checked both the VMware application log and the vm-specific log and I don't see anything specific to this; no coincident entries.

Tony0945 · Posted: Mon Jun 18, 2018 2:36 pm Post subject:

Just upgraded my own server and while doing etc-update I see this change in /etc/ssh/ssh_config

Whissi · Retired Dev Joined: 12 Jan 2011 Posts: 222

Please try setting IPQoS to a different value, i.e.

bunder · Bodhisattva Joined: 10 Apr 2004 Posts: 5947

mine came back after a reboot, i'm almost definitely sure its gnome-keyring (i kill it then it stops). the only problem is, i don't know how/where to clear out its entries or disable the ssh bits.

edit: logged out, killed gnome-keyring, deleted ~/.gnupg/* and ~/.local/share/keyrings/*, logged back in and i still get that signature error, argh
_________________