golang1.7.3的ssh調試，支援diffie-hellman-group-exchange-sha1和aes128-cbc的裝置

這是一個建立於 的文章，其中的資訊可能已經有所發展或是發生改變。

查看裝置支援的kex交換演算法和密碼編譯演算法

debug1: SSH2_MSG_KEXINIT sentdebug1: SSH2_MSG_KEXINIT receiveddebug1: kex: algorithm: diffie-hellman-group-exchange-sha1debug1: kex: host key algorithm: ssh-rsadebug1: kex: server->client cipher: aes128-cbc MAC: hmac-sha1 compression: nonedebug1: kex: client->server cipher: aes128-cbc MAC: hmac-sha1 compression: none

查看golang支援的演算法，在golang.org/x/crypto/common.go,發現預設沒指定aes128-cbc

var supportedCiphers = []string{ "aes128-ctr", "aes192-ctr", "aes256-ctr", "aes128-gcm@openssh.com", "arcfour256", "arcfour128",}// supportedKexAlgos specifies the supported key-exchange algorithms in// preference order.var supportedKexAlgos = []string{ // P384 and P521 are not constant-time yet, but since we don't // reuse ephemeral keys, using them for ECDH should be OK. kexAlgoECDH256, kexAlgoECDH384, kexAlgoECDH521, kexAlgoDH14SHA1, kexAlgoDH1SHA1,}// supportedKexAlgos specifies the supported host-key algorithms (i.e. methods// of authenticating servers) in preference order.var supportedHostKeyAlgos = []string{ CertAlgoRSAv01, CertAlgoDSAv01, CertAlgoECDSA256v01, CertAlgoECDSA384v01, CertAlgoECDSA521v01, KeyAlgoECDSA256, KeyAlgoECDSA384, KeyAlgoECDSA521, KeyAlgoRSA, KeyAlgoDSA,}// supportedMACs specifies a default set of MAC algorithms in preference order.// This is based on RFC 4253, section 6.4, but with hmac-md5 variants removed// because they have reached the end of their useful life.var supportedMACs = []string{ "hmac-sha1", "hmac-sha1-96",}

指定aes128-cbc演算法，仍然報錯ssh: handshake failed: ssh: no common algorithms

Config: Config{ Ciphers:      []string{"aes128-cbc", "3des-cbc", "des-cbc"}, MACs:         []string{"hmac-sha1"}, },

查看代碼Unit裡面not currently support aes128-cbc，又查看github的issue有人做了PR，所以下載最新版本

Paste_Image.png

下載最新版本crypto後修改supportedCiphers增加預設支援aes128-cbc

var supportedCiphers = []string{        "aes128-cbc",        "aes128-ctr", "aes192-ctr", "aes256-ctr",        "aes128-gcm@openssh.com",        "arcfour256", "arcfour128",}

golang代理程式測試成功

-bash-4.3$ telnet 127.0.0.1 2322Trying 127.0.0.1...Connected to 127.0.0.1.Escape character is '^]'.ssh2 proxyusage:ssh2 ip[:port] user pass>ssh2 1.1.1.1 aaa aaaInfo: The max number of VTY users is 20, and the number      of current VTY users on line is 2.      The current login time is 2017-03-01 21:17:15.<HK-HK-CW-F-1.CN2>display cur

後續

還有很多問題，代理的空格發送斷行符號，效能測試等。
另外sha1已經被破解，但sha256，golang還沒有支援。。。。