Page MenuHomeVyOS Platform

ssh: defining cipher rijndael-cbc@lysator.liu.se will break SSH daemon
Closed, ResolvedPublicFEATURE REQUEST

Description

Defining SSH cipher rijndael-cbc@lysator.liu.se as

set service ssh ciphers rijndael-cbc@lysator.liu.se

will break the daemon (found here https://github.com/vyos/vyos-1x/pull/4896#pullrequestreview-3571265564 by @natali-rs1985)

Dec 13 20:08:27 systemd[1]: Starting OpenBSD Secure Shell server...
Dec 13 20:08:27 ip[5411]: /run/sshd/sshd_config line 53: Bad SSH2 cipher spec 'rijndael-cbc@lysator.liu.se'.
Dec 13 20:08:27 systemd[1]: ssh@default.service: Main process exited, code=exited, status=255/EXCEPTION
Dec 13 20:08:27 systemd[1]: ssh@default.service: Failed with result 'exit-code'.
Dec 13 20:08:27 systemd[1]: Failed to start OpenBSD Secure Shell server.
Dec 13 20:08:38 systemd[1]: ssh@default.service: Scheduled restart job, restart counter is at 10.
Dec 13 20:08:38 systemd[1]: Stopped OpenBSD Secure Shell server.

According to https://bbs.archlinux.org/viewtopic.php?id=188613 rijndael-cbc@lysator.liu.se was removed in OpenSSH 6.7 https://www.openssh.org/txt/release-6.7

sshd(8): The default set of ciphers and MACs has been altered to remove unsafe algorithms. In particular, CBC ciphers and arcfour* are disabled by default.

The currently supported cipher list in Debian Bookworm (VyOS 1.4 and VyOS 1.5) is:

vyos@vyos:~$ ssh -Q cipher
3des-cbc
aes128-cbc
aes192-cbc
aes256-cbc
aes128-ctr
aes192-ctr
aes256-ctr
aes128-gcm@openssh.com
aes256-gcm@openssh.com
chacha20-poly1305@openssh.com

Details

Version
1.4.3
Is it a breaking change?
Config syntax change (migratable)
Issue type
Feature (new functionality)

Event Timeline

c-po changed the task status from Open to In progress.
c-po claimed this task.
c-po triaged this task as High priority.
c-po added a project: VyOS 1.4 Sagitta (1.4.4).
c-po changed Version from - to 1.4.3.
c-po updated the task description. (Show Details)
dmbaturin changed Is it a breaking change? from Unspecified (possibly destroys the router) to Config syntax change (migratable).