Re: Identifying a buggy SFTP server found at an archaeological dig
Ron Frederick <[email protected]> Tue, 14 May 2024 18:20:26 -0700
| Newsgroups | gmane.ietf.secsh |
|---|---|
| Message-ID | <[email protected]> |
--Apple-Mail=_8345E47A-53E1-4FEF-8CE5-F1BB70236050 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 On May 12, 2024, at 3:08=E2=80=AFAM, Peter Gutmann = <[email protected]> wrote: > Ron Frederick <[email protected]> writes: >> Alternately, you could try and work around this by having your client = not >> advertise any of the group-exchange kex algorithms (anything starting = with >> "diffie-hellman-group-exchange-=E2=80=9C). >=20 > That's somewhat overkill, I don't want to remove any GEX capability = just to > deal with one broken server. I think: >=20 > "SSH-2.0-FTP Server ready" -> SSH_MSG_KEY_DH_GEX_REQUEST_OLD > "SSH-2.0-Chilkat_<version>" -> SSH_MSG_KEY_DH_GEX_REQUEST >=20 > will do for now, since it fixes the problem with the broken = implementation and > doesn't affect any other implementations (I've already got code paths = in there > for other implementatons that need this, it's just that the behaviour = of this > particular Chilkat server was a new one for me). I'll report back if = this > causes any problems in case the info is of use to others. This assumes that the Chilkat SSH version string changed at the same = time as the support for GEX_REQUEST was added. Otherwise, there might be = versions with the new version string that still only support = GEX_REQUEST_OLD or vice-versa. It=E2=80=99s also not clear whether the version string change was = actually a change in the Chilkat defaults, or if one or both of them was = actually explicit configuration on a specific server and not applicable = to other server instances (though I=E2=80=99ll admit that=E2=80=99s a = bit unlikely). That said, if this works for the servers you need to connect to, = that=E2=80=99s great... --=20 Ron Frederick [email protected] --Apple-Mail=_8345E47A-53E1-4FEF-8CE5-F1BB70236050 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 <html><head><meta http-equiv=3D"content-type" content=3D"text/html; = charset=3Dutf-8"></head><body style=3D"overflow-wrap: break-word; = -webkit-nbsp-mode: space; line-break: after-white-space;">On May 12, = 2024, at 3:08=E2=80=AFAM, Peter Gutmann = <[email protected]> wrote:<div><blockquote = type=3D"cite"><div><div>Ron Frederick <[email protected]> = writes:<br><blockquote type=3D"cite">Alternately, you could try and work = around this by having your client not<br>advertise any of the = group-exchange kex algorithms (anything starting = with<br>"diffie-hellman-group-exchange-=E2=80=9C).<br></blockquote><br>Tha= t's somewhat overkill, I don't want to remove any GEX capability just = to<br>deal with one broken server. I think:<br><br>"SSH-2.0-FTP = Server ready" -> = SSH_MSG_KEY_DH_GEX_REQUEST_OLD<br>"SSH-2.0-Chilkat_<version>" = -> SSH_MSG_KEY_DH_GEX_REQUEST<br><br>will do for now, since it fixes = the problem with the broken implementation and<br>doesn't affect any = other implementations (I've already got code paths in there<br>for other = implementatons that need this, it's just that the behaviour of = this<br>particular Chilkat server was a new one for me). I'll = report back if this<br>causes any problems in case the info is of use to = others.<br></div></div></blockquote><div><br></div>This assumes that the = Chilkat SSH version string changed at the same time as the support for = GEX_REQUEST was added. Otherwise, there might be versions with the new = version string that still only support GEX_REQUEST_OLD or = vice-versa.</div><div><br></div><div>It=E2=80=99s also not clear whether = the version string change was actually a change in the Chilkat defaults, = or if one or both of them was actually explicit configuration on a = specific server and not applicable to other server instances (though = I=E2=80=99ll admit that=E2=80=99s a bit = unlikely).</div><div><br></div><div>That said, if this works for the = servers you need to connect to, that=E2=80=99s great...</div><div> -- <br>Ron Frederick<br>[email protected]<br><br><br> </div> <br></body></html>= --Apple-Mail=_8345E47A-53E1-4FEF-8CE5-F1BB70236050--