Hello:
Thank you very much for taking the time to write.
On 5 Dec 2021 at 19:57, Tavis Ormandy wrote:
... wants diffie-hellman-group1-sha1, you will need to add it to the
allowed KexAlgorithms in sshd_config. It's disabled by default for a
reason ...
Indeed.
But I'd think (?) that in this specific case, the risks of using a deprecated algorithm may be attenuated by three things:
1.
Access to the ADSL router via WiFi is MAC filtered.
It will only allow *this* specific Palm T|X handheld to log in.
2.
A (relatively) complex WPA/WPA2 PSK mixed PW such as this one is used:
[code]
4N@8974+6231
[/code]
3.
WiFi is enabled on a per-case basis.
When I started with this project, trying to define exactly *what* the ssh sever wanted to see on a connection attempt was the first problem.
The PalmOS application I am attempting to use (pssh) is as dated as the Palm T|X itself and instructions or information with respect to how it is supposed to be used is very scarce.
It has been reported that the binary has a string that reads "Ciphers other than DES-EDE3-CBC not supported" but for some reason this message is not displayed to the user.
As a result, importing a key that did not conform to this was met with a pop-up that reads:
---
Incorrect passphrase, or incorrectly formatted memo
---
After a few accumulated hours attempting different options I finally managed to generate a key that was accepted by the application and imported without issue:
[code]
:~$ openssl genrsa -out t1.key 1024
Generating RSA private key, 1024 bit long modulus
...+++++
.........+++++
e is 65537 (0x010001)
[/code]
This got me three files:
- file
- file.pub
- t1.key
I edited the destination system's /etc/ssh/sshd_config file to add this line:
[code]
# Ciphers and keying
Ciphers +ssh-rsa
[/code]
I then stopped/started the ssh service and received this:
[code]
~$ sudo service ssh start
[....] Starting OpenBSD Secure Shell server: sshd/etc/ssh/sshd_config line 23: Bad SSH2 cipher spec '+ssh-rsa'.
failed!
~$
[/code]
The installed version is OpenSSH_7.4p1 Debian-10+deb9u7.
I have not found a way to get around this and I'd say that downgrading to an earlier version would not be acceptable.
I'm not in any way versed i