lsh-bugs

lsh-bugs@lists.lysator.liu.se

491 discussions

ssh agent support?
by Simon Josefsson 17 Apr '12

17 Apr '12

I use a smartcard to do SSH authentication today, which works fine with OpenSSH. Is there any support for agent-style public-key authentication in lsh? Any plans? The agent protocol appears stable, and is used by several projects already (ssh, gpg-agent, libssh2, maybe others). /Simon

3 5

Re: Migration from CVS to GIT
by nisse＠lysator.liu.se 04 Feb '12

04 Feb '12

Martin Storsjö <martin(a)martin.st> writes: > The author mapping looks good to me at least, looking forward to the > final repo Now "final". Repo url git://git.lysator.liu.se/lsh/lsh.git. I renamed the old gitorious "project" to get the various test repositories out of the way. After the conversion, I have pushed some tags to all branches to mark the conversion. On master only, I have eliminatd $Id tags in files, and converted all textfiles to utf-8 (encoding marks in texinfo and html not yet updated, though). > (including separated nettle)! Not there yet. Regards, /Niels -- Niels Möller. PGP-encrypted email is preferred. Keyid C0B98E26. Internet email is subject to wholesale government surveillance.

2 1

Migration from CVS to GIT
by nisse＠lysator.liu.se 31 Jan '12

31 Jan '12

I'm finally looking into conversion of the lsh repository from CVS to GIT, and this naturally also includes nettle. A public test repository can be found at lysator's gitorious installation, at http://git.lysator.liu.se/lsh/test-2. The conversion was done by the pcvs2git.pike program (see git://pike-git.lysator.liu.se/pcvs2git.git), and I got some help from Henrik Grubbström to write a config file to handle the few peculiarities in the lsh repository. The intention is that the new git repository should include all branches and tags from the old cvs repository, and record major merge events, like the 2006-05-16 merge from the experimental branch to the trunk. Please test, and if all goes well I'll rename this repository to "lsh" (or recreate, if I can't figure out how to do repository renames with gitorious). If this first steps works out ok, step two is to do a some cleanups (switching to utf-8 for the files, deleting old $Id$ tags, etc). And then step three is to extract the nettle subdirectory as an independent project and repository, using git subtree of git filter-branch or so (I'm not sure what's the best tool for that job). Other sub-projects, e.g., the argp implementation, can be split out later, if desired. For the few "common files" (e.g., misc/run-tests), they'll simply have to be duplicated in several repositories. If I still want to bundle nettle with the lsh distribution, I'll handle that by setting up some symlink in my working tree. git submodule is probably not a solution, and git subtree is most likely overkill. The old CVS repository can be considered read-only now. Regards, /Niels -- Niels Möller. PGP-encrypted email is preferred. Keyid C0B98E26. Internet email is subject to wholesale government surveillance.

1 1

Re: Migration from CVS to GIT
by nisse＠lysator.liu.se 24 Jan '12

24 Jan '12

Martin Storsjö <martin(a)martin.st> writes: > I'd hope for a round of filter-branch to rewrite author names in git > to the original author of patches. I was thinking that it's good enough to convert the information recorded by cvs. But it's certainly possible to add specified author names for certain commits, as a part of the conversion process. The config/Pike-real-authors file (from the git://pike-git.lysator.liu.se/pcvs2git.git repository) is an example of what that input file should look like. Since I haven't used it I'm not sure how it works, but I could try to find out. But it's going to be some manual work, going through the ChangeLog files looking for contributed changes, and then looking at the cvs log to identify affected revisions and writing the input file for --contributors. > If you don't feel up to doing this yourself, I can try to give it a go. If you want to give it a try, I'll explain what's needed. 1. Get pike 7.8 release 550 or later, http://pike.ida.liu.se/pub/pike/beta/7.8.550/Pike-v7.8.550.tar.gz Annoyingly enough, it doesn't support the most recent version of nettle, resulting in compilation errors on the DES glue. I had to #if out the DES and DES3 ciphers from the Nettle module. Alternatively, there should be some configure argument to force Pike to build with the bundled version of nettle, rather than the installed version. 2. Get git://pike-git.lysator.liu.se/pcvs2git.git. This includes Henrik's configuration file in config/lsh.pcvs2git. 3. Get the CVS repository. I'm putting a copy at http://www.lysator.liu.se/~nisse/misc/lsh-cvsroot.tar.gz 4. Create an authors.txt file, containing nisse=Niels Möller <nisse(a)lysator.liu.se> uid444=Niels Möller <nisse(a)lysator.liu.se> _cvs_pont=Pontus Freyhult <pont(a)soua.net> 5. To do the conversion, I used the command line pike ../pcvs2git/pcvs2git.pike -c ../pcvs2git/config/lsh.pcvs2git \ -A authors.txt -k -l -C lsh.git -d lsh-cvsroot/lsh It spawns a git fast-import process which populates the new repository. The result should be almost identical to the current "test-2" repository (Henrik has committed some tweaks for the generated .gitattributes files). To use a contributors file, add --contributors contributors.txt early on the above command line (the -d option and argument has to come after other options). Regards, /Niels -- Niels Möller. PGP-encrypted email is preferred. Keyid C0B98E26. Internet email is subject to wholesale government surveillance.

1 0

Trying to find ssh2 libs
by Goran Hasse 25 Sep '08

25 Sep '08

Dear all... We have build a small IO-device thate are ment to be connected on internet. Take a look at http://www.ipio.nu In the next version of this we want to use AVR32 and use uCLinux as operating system. On the device we will have som simple server to control it. SSL seems to be to many things and OpenSSH have no libraries that we can use. libssh2 seems to be what we want for a client - but we could not find any simple "server side" libraries. We don't want X11-forwaring, and all other fantastic things. Just authentication and a secure channel. Nothing more! Is there any possibility that lsh can do the work for us? (How do we get rid of all nice features ;-) -- gorhas(a)gmail.com Mob: 070-5530148

2 1

ANNOUNCE: lsh-2.0.4
by nisse＠lysator.liu.se 05 Sep '07

05 Sep '07

This is a pure bugfix release, fixing the x11 forwarding bug discussed recently on this list. News for the 2.0.4 release Fixed x11 forwarding bug in the lsh client. Licensing: I don't find it appropriate to make any licensing change for a single-line update like this. Hence, like all previous versions of lsh, this version is released under "GNU GPL version 2 or (at your option) later". However, future versions will most likely be released under GPL version 3. Available at http://www.lysator.liu.se/~nisse/archive/lsh-2.0.4.tar.gz ftp://ftp.lysator.liu.se/pub/security/lsh/lsh-2.0.4.tar.gz or apply the below patch to lsh-2.0.3. Regards, /Niels diff -u -r1.892 -r1.893.2.1 --- ChangeLog 8 May 2006 19:18:34 -0000 1.892 +++ ChangeLog 5 Sep 2007 18:32:59 -0000 1.893.2.1 @@ -1,3 +1,15 @@ +2007-09-05 Niels Möller <nisse(a)lysator.liu.se> + + * src/client_x11.c (do_client_channel_x11_receive): Fixed parser + bookkeeping. Was broken before the 1.5.4 release. Problem reported + by Kaloian Doganov. + +2006-05-09 Niels Möller <nisse(a)lysator.liu.se> + + * configure.ac: Bumped version number to 2.0.4. + + * Released lsh-2.0.2. + 2006-05-08 Niels Möller <nisse(a)lysator.liu.se> * doc/ssh-conv.1: Changed to ordinary line breaks in example diff -u -r1.126 -r1.126.2.1 --- NEWS 8 May 2006 20:28:30 -0000 1.126 +++ NEWS 5 Sep 2007 18:51:38 -0000 1.126.2.1 @@ -1,3 +1,7 @@ +News for the 2.0.4 release + + Fixed x11 forwarding bug in the lsh client. + News for the 2.0.3 release At startup, lshd now tries to close any spurious open file diff -u -r1.63 -r1.64 --- configure.ac 29 Apr 2006 20:00:10 -0000 1.63 +++ configure.ac 9 May 2006 18:16:30 -0000 1.64 @@ -1,5 +1,5 @@ dnl Process this file with autoconf to produce a configure script. -AC_INIT([lsh], [2.0.3], [bug-lsh(a)gnu.org]) +AC_INIT([lsh], [2.0.4], [bug-lsh(a)gnu.org]) AC_PREREQ(2.52) AC_CONFIG_SRCDIR([src/lsh.c]) # Needed to stop autoconf from looking for files in parent directories. diff -u -r1.26 -r1.26.4.1 --- src/client_x11.c 16 Nov 2003 18:40:37 -0000 1.26 +++ src/client_x11.c 5 Sep 2007 18:32:48 -0000 1.26.4.1 @@ -211,6 +211,7 @@ /* The small initial window size should ensure that all the data fits. */ lsh_string_write_string(self->buffer, self->i, data); + self->i += lsh_string_length(data); lsh_string_free(data); buffer = lsh_string_data(self->buffer);

1 0

Re: can't connect to lshd using midpssh
by nisse＠lysator.liu.se 18 Jul '07

18 Jul '07

Christiaan Welvaart <cjw(a)daneel.dyndns.org> writes: > Your example describes the actual problem: lsh-keygen defaults to RSA > while midpssh only supports DSA. After switching to a DSA hostkey, I > got: > > lshd: pty_open_slave: Invalid terminal modes from client. > > The CHANNEL_REQUEST was: > > 00000000: 6200000000000000077074792d726571 b........pty-req > 00000010: 000000000576743332300000003e0000 .....vt320...>.. > 00000020: 0028000000000000000000000000 .(............ > ^^^^^^^^ > Now the RFC 4254 is a bit strange, because it lists this field as: > > string encoded terminal modes > > while the description says it is a byte stream that is terminated by > opcode TTY_OP_END (0x00). So I'm not sure if the pty-req request from > midpssh is valid. With the patch below applied to lshd I can get a > shell, though. I'm in a hurry (packing for summer vacation), but I think most of the blame should be on midpssh. * I'm assuming that midpssh implements some kind of terminal emulation, presumably vt320. Otherwise, sending a pty-req doesn't make much sense. Then it ought to tell the server what terminal modes it is emulating, or it can expect a broken user experience. * But on the server side, it would make some sense to allow an empty terminal mode string, and interpret it as "I'm happy with any random selection of terminal modes that one gets by default on this particular operating system when requesting a new pty-pair." In lshd, I think it would be cleaner to do that check elsewhere, though, and never call tty_decode_term_mode at all if the provided string is empty. Regards, /Niels

1 0

can't connect to lshd using midpssh
by Christiaan Welvaart 26 Jun '07

26 Jun '07

hi, When I try to initiate a session using MidpSSH [1] I get: Protocol error: No common hostkey algorithm.^M What could be causing this, or how can I debug the problem? >From the source code and the RFC I see that the hostkey algorithm is pretty much always ssh-dss, so maybe the real problem is somehwere else. I'm using lshd 2.0.3 . Christiaan [1] http://www.xk72.com/midpssh/ - version 1.6.0

2 1

Can't get X forwading working
by Kaloian Doganov 04 Jun '07

04 Jun '07

(I'm not sure whether this mailing list the apropriate place to report bugs or problems with GNU lsh. If it is not, please point me to the right place.) Using GNU lsh 2.9-exp to login on a remote host ("mafra", running OpenSSH server with X11 forwarding enabled, of course), I end up with no DISPLAY environment variable on the remote host: --------------------8<-------------------- $ /usr/local/bin/lsh --x11-forward --verbose mafra.doganov.org lsh: Enabling default escape character `~' lsh: Could not open gateway: (errno = 2): No such file or directory lsh: Starting /usr/local/bin/lsh-transport. Passphrase for key `kaloian@millenium-falcon': lsh-transport: Connecting to mafra.doganov.org:22.... lsh-transport: ... connected. lsh-transport: Server version string: SSH-2.0-OpenSSH_4.3p2 Debian-9 lsh-transport: Received KEXINIT message. Key exchange initated. lsh-transport: Selected keyexchange algorithm: diffie-hellman-group14-sha1 with hostkey algorithm: ssh-rsa lsh-transport: Selected bulk algorithms: (client to server, server to client) Encryption: (aes256-cbc, aes256-cbc) Message authentication: (hmac-sha1, hmac-sha1) Compression: (none, none) lsh-transport: SPKI host authorization successful! lsh-transport: Requesting authentication using the `publickey' method. lsh-transport: Received USERAUTH_SUCCESS. lsh: Allocated local channel number 0 lsh: pty request succeeded Linux mafra 2.6.18-4-686 #1 SMP Wed May 9 23:03:12 UTC 2007 i686 The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright. Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. Last login: Sun Jun 3 22:52:11 2007 from 141.201.pppoe.intech.bg kaloian@mafra:~$ echo $DISPLAY kaloian@mafra:~$ --------------------8<-------------------- The same example case goes a little further when I try to execute it with GNU lsh 2.0.3: --------------------8<-------------------- $ /usr/local/bin/lsh --x11-forward --verbose mafra.doganov.org lsh: Enabling default escape character `~' lsh: Using local X11 transport `/tmp/.X11-unix/X0' Passphrase for key `kaloian@millenium-falcon': lsh: garbage collecting... lsh: Objects alive: 88, garbage collected: 24 lsh: Client version: SSH-2.0-lsh-2.0.3 lsh - a GNU ssh Server version: SSH-2.0-OpenSSH_4.3p2 Debian-9 lsh: Received KEXINIT message. Key exchange initated. lsh: Selected keyexchange algorithm: diffie-hellman-group14-sha1 with hostkey algorithm: ssh-rsa lsh: Selected bulk algorithms: (client to server, server to client) Encryption: (aes256-cbc, aes256-cbc) Message authentication: (hmac-sha1, hmac-sha1) Compression: (none, none) lsh: SPKI host authorization successful! lsh: Received NEWKEYS. Key exchange finished. lsh: Setting session key lifetime to 2400 seconds lsh: Requesting authentication using the `none' method. lsh: Requesting authentication using the `publickey' method. lsh: Requesting authentication using the `publickey' method. lsh: SSH_MSG_USERAUTH_PK_OK received lsh: Sending `publickey' signature. lsh: User authentication successful. lsh: Allocated local channel number 0 lsh: Registering local channel 0. lsh: Taking channel 0 in use, (local 0). lsh: Requesting a remote pty. lsh: Requesting X11 forwarding. lsh: pty request succeeded lsh: X11 request succeeded Linux mafra 2.6.18-4-686 #1 SMP Wed May 9 23:03:12 UTC 2007 i686 The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright. Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. Last login: Sun Jun 3 22:52:22 2007 from 141.201.pppoe.intech.bg kaloian@mafra:~$ echo $DISPLAY localhost:10.0 kaloian@mafra:~$ xclock lsh: Allocated local channel number 1 lsh: x11 connection attempt, originator: 127.0.0.1:50836 lsh: Registering local channel 1. lsh: Taking channel 3 in use, (local 1). --------------------8<-------------------- xclock hangs forever at this point and xclock's window is not displayed on the X server. The same test with openssh -X leads to xclock's window actually displayed on the X server. -- Protect your digital freedom and privacy, eliminate DRM, learn more at http://www.defectivebydesign.org/what_is_drm

2 2

Re: Converting private key from OpenSSH to lsh (or the other way around)
by nisse＠lysator.liu.se 04 Jun '07

04 Jun '07

Simon Josefsson <simon(a)josefsson.org> writes: > If it would help someone, there is code in libssh2 that I wrote which > decodes unencrypted OpenSSL private keys (which apparently is what > OpenSSH is using) and imports them into a libgcrypt sexp. Does openssl and openssh use the PKCS#1 format for private keys, as the DER encoding of ASN.1 objects? (Maybe that spec is for RSA keys only, but if so there ought to be some related spec for DSA). I would have expected openssh to use something closer to the ssh wireformat, i.e., the wireformat ssh-rsa/ssh-dsa with some additional felds for the secret information, like I think the old proprietary ssh program did. For PKCS#1 format, the program pkcs1-conv (from nettle-1.14 and later) can also convert RSA keys in pkcs#1 formats to sexp format. Regards, /Niels

3 5

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

2001

2000

lsh-bugs