OpenSolaris

Printable Version Enter a New Search
Bug ID 6850734
Synopsis enabled aes192/aes256 support in ssh/sshd does not work on S10u3 or older released
State 7-Fix in Progress (Fix is in progress)
Category:Subcategory ssh:commands
Keywords BOP
Responsible Engineer Peter Shoults
Reported Against s10 , 5.10 , s10u3_03 , s10u9_01 , s10u3_fcs , solaris_10u2 , solaris_10u3
Duplicate Of
Introduced In solaris_10u8
Commit to Fix s10u9_02
Fixed In
Release Fixed
Related Bugs 6498066 , 6617424 , 6759852 , 6845911
Submit Date 12-June-2009
Last Update Date 3-November-2009
Description
The bugfix for 6617424 enabled the support of aes192/aes256 in ssh and sshd. This feature has a dependency on the strong cyrpto packages (SUNWcry*) and these packages are not available on all systems.

In Nevada and in Solaris 10 Update 4 or later this is not a problem (as PSARC/2006/610 and CR 6498066 has removed the spearate encryption pacage and bundled the required packages into the regular release).

Systems running Solaris 10 Update 3 or older however still need the separate packages to be able to offer the aes192/aes256 ciphers. If such an older Solaris 10 system is patched with patch 141742-01 (sparc) or 140119-01 (x86) then sshd/sshd will offer aes192/aes256 in the key exchange even though these algortihms are not available. Depending on the negotiation results ssh/sshd will select one of these unavailable ciphers which will then cause connection failures (putty as an ssh client is such an example as it prefers AES256).

On the server you'll see the following messages as the result of such a failed attempts to use aes256 to a box which doesn't have the SUNWcry* packages installed:
[...]
Jun 10 16:03:41 hostname sshd[2168]: [ID 800047 auth.crit] fatal: matching cipher is not supported: aes256-cbc
Jun 10 16:03:56 hostname sshd[2174]: [ID 800047 auth.crit] fatal: matching cipher is not supported: aes256-ctr
Jun 10 16:11:47 hostname sshd[2214]: [ID 800047 auth.crit] fatal: matching cipher is not supported: aes256-cbc
Jun 10 16:11:50 hostname sshd[2220]: [ID 800047 auth.crit] fatal: matching cipher is not supported: aes256-cbc
[...]

The problem is a missing patch dependency of 141742-01 on the SUNWcry* packages.
Work Around
A workaround is to disable the use of aes192/aes256 ciphers for ssh and sshd. Change the two config files /etc/ssh/ssh_config and /etc/ssh/sshd_config and add the following line:

Ciphers        aes128-ctr,aes128-cbc,arcfour,3des-cbc,blowfish-cbc

You'll have to restart sshd to pickup the change ("svcadm restart ssh").
Comments
N/A