处理ssh客户端与服务器加密逻辑不匹配问题

本人在windows下一直在使用一款sftp网络磁盘映射工具 sftpDrive Manager V1.7.9，它能方便的把安装ssh-server的服务器的某个文件夹映射为windows下的网络磁盘。

在升级了ubuntu 16.04 后，发现不能通过该软件映射网络磁盘了，提示 incompatible ssh algorithms （不兼容的加密方式）。

 

ubuntu16.04下设置sshd的log级别为DEBUG，然后观察sftpDrive与服务端连接时的日志（/var/log/auth.log），摘抄如下：

Oct 30 18:36:21 lbq-ThinkStation-P320 sshd[30195]: debug1: Forked child 30225.  

Oct 30 18:36:21 lbq-ThinkStation-P320 sshd[30225]: debug1: Set /proc/self/oom_score_adj to 0  

Oct 30 18:36:21 lbq-ThinkStation-P320 sshd[30225]: debug1: rexec start in 5 out 5 newsock 5 pipe 7 sock 8  

Oct 30 18:36:21 lbq-ThinkStation-P320 sshd[30225]: debug1: inetd sockets after dupping: 3, 3  

Oct 30 18:36:21 lbq-ThinkStation-P320 sshd[30225]: Connection from 192.168.99.1 port 13329 on 192.168.99.199 port 22  

Oct 30 18:36:21 lbq-ThinkStation-P320 sshd[30225]: debug1: Client protocol version 2.0; client software version SftpDrive_1.5  

Oct 30 18:36:21 lbq-ThinkStation-P320 sshd[30225]: debug1: no match: SftpDrive_1.5  

Oct 30 18:36:21 lbq-ThinkStation-P320 sshd[30225]: debug1: Enabling compatibility mode for protocol 2.0  

Oct 30 18:36:21 lbq-ThinkStation-P320 sshd[30225]: debug1: Local version string SSH-2.0-OpenSSH_7.2p2 Ubuntu-4ubuntu2.2  

Oct 30 18:36:21 lbq-ThinkStation-P320 sshd[30225]: debug1: permanently_set_uid: 121/65534 [preauth]  

Oct 30 18:36:21 lbq-ThinkStation-P320 sshd[30225]: debug1: list_hostkey_types: ssh-rsa,rsa-sha2-512,rsa-sha2-256,ecdsa-sha2-nistp256,ssh-ed25519 [preauth]  

Oct 30 18:36:21 lbq-ThinkStation-P320 sshd[30225]: debug1: SSH2_MSG_KEXINIT sent [preauth]  

Oct 30 18:36:21 lbq-ThinkStation-P320 sshd[30225]: debug1: SSH2_MSG_KEXINIT received [preauth]  

Oct 30 18:36:21 lbq-ThinkStation-P320 sshd[30225]: debug1: kex: algorithm: (no match) [preauth]  

Oct 30 18:36:21 lbq-ThinkStation-P320 sshd[30225]: fatal: Unable to negotiate with 192.168.99.1 port 13329: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth]  

Oct 30 18:36:21 lbq-ThinkStation-P320 sshd[30225]: debug1: do_cleanup [preauth]  

Oct 30 18:36:21 lbq-ThinkStation-P320 sshd[30225]: debug1: monitor_read_log: child log fd closed  

 

可以发现，好像是ubuntu16.04上的ssh-server不支持sftpDrive的diffie-hellman-group1-sha1加密方式。

由于sftpDrive软件不再维护，也没发现在哪配置其他加密方式，只能通过修改ssh-server端来适应客户端需求。

 

网上搜索一番，发现提供了解决方案：

After reading this and this I came up with the changes I needed to do to the /etc/ssh/sshd_configfile:

#Legacy changes

KexAlgorithms +diffie-hellman-group1-sha1

Ciphers +aes128-cbc

But a more wide legacy set of changes is (taken from here)

#Legacy changes

KexAlgorithms diffie-hellman-group1-sha1,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1

Ciphers 3des-cbc,blowfish-cbc,aes128-cbc,aes128-ctr,aes256-ctr