Cannot connect via Synapse and SSH to a linux box
lazarus / 38-Networking and Web Programming

----------------------------------------------------------------------
Pascal · 2016-10-06 12:10

Hello,

i used the source samples on
http://wiki.lazarus.freepascal.org/Synapse to build a test prog
for connecting via SSH to remote machine (using cryptlib 3.4.2 on
windos 10).

Code: Pascal  [Select][+][-]window.onload = function(){var x1 =
document.getElementById("main_content_section"); if (x1) { var x =
document.getElementsByClassName("geshi");for (var i = 0; i program
TestSSHClient; {Test program for telnetsshclient Written by Reinier
Olislagers 2011.Modified for libssh2 by Alexey Suhinin 2012. License
of code:* MIT* LGPLv2 or later (with FreePascal static linking
exception)* GPLv2 or lateraccording to your choice.Free use allowed
but please don't sue or blame me. Uses other libraries/components;
different licenses may apply that also can influence the
combined/compiled work. Run: sshtest <serverIPorhostname>
[PrivateKeyFile]}{$mode objfpc}{$H+}{$APPTYPE CONSOLE} uses 
telnetsshclient;var  comm: TTelnetSSHClient;  Command: string;begin 
writeln('Starting.');  comm:=TTelnetSSHClient.Create;  comm.HostName:=
'linuxmachine'; // ParamStr(1); //First argument on command line  if
comm.HostName='' then  begin    writeln('Please specify hostname on
command line.');    halt(1);  end;   comm.PrivateKeyFile := '';  
comm.TargetPort:=''; //auto determine based on protocoltype 
comm.UserName:='user'; //change to your situation 
comm.Password:='password'; //change to your situation 
comm.ProtocolType:=SSH; //Telnet or SSH  writeln(comm.Connect); //Show
result of connection  if comm.Connected then  begin   
writeln('Server: ' + comm.HostName + ':'+comm.TargetPort+', user:
'+comm.UserName);    writeln('Welcome message:');   
writeln(comm.WelcomeMessage);    Command:='ls -al';    writeln('***
Sending ' + Command);    writeln('*** Begin result****');   
writeln(comm.CommandResult(Command));    writeln('*** End
result****');    writeln('');    writeln('');    Command:='df -h';   
writeln('*** Sending ' + Command);    writeln('*** Begin
result****');    writeln(comm.CommandResult(Command));    writeln('***
End result****');    writeln('');    writeln('');    writeln('All
output:');    writeln('*** Begin result****');   
writeln(comm.AllOutput);    writeln('*** End result****');   
comm.Disconnect;  end  else  begin    writeln('Connection to ' +     
comm.HostName + ':' +      comm.TargetPort + ' failed.');  end; 
comm.Free;end.
This works for AIX 7.1 but not for linux or ubuntu.

What am i making wrong or missing?

----------------------------------------------------------------------
rvk · 2016-10-06 13:06

Did you remove the {$DEFINE LIBSSH2} in telnetsshclient.pas?

Otherwise you're not using the cryptlib 3.4.2  library and LIBSSH2.DLL
will be used (which you didn't install but might be present on the
AIX).

Code: Pascal  [Select][+][-]window.onload = function(){var x1 =
document.getElementById("main_content_section"); if (x1) { var x =
document.getElementsByClassName("geshi");for (var i = 0; i {$mode
objfpc}{$H+}{$DEFINE HAS_SSH_SUPPORT} //comment out if only telnet
support required{$DEFINE LIBSSH2} interface uses  Classes, SysUtils, 
tlntsend  {$IFDEF HAS_SSH_SUPPORT}  {ssl - or actually ssh - libs
required by tlntsend}    {$IFDEF LIBSSH2}      ssl_libssh2    {$ELSE} 
    ssl_cryptlib  {$ENDIF}  {$ENDIF HAS_SSH_SUPPORT}  ;

----------------------------------------------------------------------
Pascal · 2016-10-06 13:24

Yes, libssh2 is disabled.

I couldn't find any suitable dll to use LIBSSH2! Otherwise i could
have tested libssh2 as well.

----------------------------------------------------------------------
rvk · 2016-10-06 14:33

Quote from: Pascal on October 06, 2016, 02:10:37 pmThis works for AIX
7.1 but not for linux or ubuntu.
And what is the problem.

(not working isn't really a good description)

----------------------------------------------------------------------
Pascal · 2016-10-06 16:09

I cannot connet/login.

----------------------------------------------------------------------
rvk · 2016-10-06 16:13

No errors?

----------------------------------------------------------------------
Thaddy · 2016-10-06 16:17

The most likely cause (I know for a fact the example code used to work
ad verbatim on linux) is that the certificate or the connection
encryption is not correct or refused because of unsafe algorithms.
E.g. if the server is running an updated version of openssl (1.0.0g or
1.1) you can't use most of the algorithms that are deemed unsafe.
The connection will never take place. Not even a refusal, but dropped.
Hence no errors.

E.g. SSLv2 won't work anymore, not even in the protocol fallback
chain. RC4 won't work anymore, more hash related things are refused.
You really need e.g. tls 1.2 and the max fallback is tls 1.1. This has
a huge impact on SSH and SSH2.
See release notes at openssl.org for openssl v1.1.
In synapse there is a setting to always use the highest encryption
possible. (Forgot the name) if you set that, everything will be OK, at
least with openssl.

----------------------------------------------------------------------
Pascal · 2016-10-06 17:09

Quote from: Thaddy on October 06, 2016, 06:17:03 pm at least with
openssl.
Okay, but where can i get the matching libssh2.dll?
Or is there a working sample program with source and dlls?

----------------------------------------------------------------------
rvk · 2016-10-06 17:19

Quote from: Pascal on October 06, 2016, 07:09:10 pmQuote from: Thaddy
on October 06, 2016, 06:17:03 pm at least with openssl.
Okay, but where can i get the matching libssh2.dll?
Or is there a working sample program with source and dlls?
The libssh2.dll shouldn't be a problem to find. But you need the
corresponding libssh2.pas with the bindings.

(Can't look myself at the moment)

----------------------------------------------------------------------
Thaddy · 2016-10-06 17:49

Well, theoretically that should not be necessary because synapse will
enumerate "unknowns" anyway and use them by priority.
There are some name clashes, though.
I'll see if I can come up with a quick fix and over the weekend
something better.
The library is pretty easy to make yourself:
https://github.com/libssh2/libssh2

(I use cygwin on windows)

Note that this is not really an FPC or Lazarus or Synapse issue.
The issue is that openssl dropped support for unsafe code, so it can
no longer be called.

----------------------------------------------------------------------
Pascal · 2016-10-07 04:00

Quote from: Thaddy on October 06, 2016, 07:49:51 pmI'll see if I can
come up with a quick fix and over the weekend something better.
This will be great. I would realy appreciate that.

----------------------------------------------------------------------
Thaddy · 2016-10-07 07:49

Can you give me the openssl version on the linux box?
Like typing this in a terminal:
Code: [Select]openssl version
OpenSSL 1.0.1t  3 May 2016

----------------------------------------------------------------------
Pascal · 2016-10-07 08:36

box 1: suselinux02
Code: Pascal  [Select][+][-]window.onload = function(){var x1 =
document.getElementById("main_content_section"); if (x1) { var x =
document.getElementsByClassName("geshi");for (var i = 0; i OpenSSL
0.9.8j-fips 07 Jan 2009Error: Error connecting to SSH server
suselinux02:22 as user d197. Technical details: No data was read
because the remote system closed the connection (recv() == 0)

box2: d197test
Code: Pascal  [Select][+][-]window.onload = function(){var x1 =
document.getElementById("main_content_section"); if (x1) { var x =
document.getElementsByClassName("geshi");for (var i = 0; i OpenSSL
0.9.8h 28 May 2008Error: Error connecting to SSH server d197test:22 as
user sg32. Technical details: Invalid PAM authentication request
packet

Edit: I used the program from post 1.

----------------------------------------------------------------------
Thaddy · 2016-10-07 10:18

These are really old. Please update these openssl versions first.
The most likely cause is based on those error messages that the
certificate is not accepted.
That can be because of multiple issues. I would generate new
certificates after I updated the openssl versions.

You *must* update openssl. These versions are highly insecure and very
easy to hack.

----------------------------------------------------------------------
Pascal · 2016-10-07 10:49

Quote from: Thaddy on October 07, 2016, 12:18:27 pmYou *must* update
openssl. These versions are highly insecure and very easy to hack.
Sorry, i can't. But never mind these machines are not publicly
available.

----------------------------------------------------------------------
Pascal · 2016-10-08 05:25

I have 2 other machines at home with the following errors:

box3: ubuntuserver
Code: Pascal  [Select][+][-]window.onload = function(){var x1 =
document.getElementById("main_content_section"); if (x1) { var x =
document.getElementsByClassName("geshi");for (var i = 0; i OpenSSL
1.0.1f 6 Jan 2014Error: Error connecting to SSH server ubuntuserver:22
as user pascal. Technical details: No algorithm compatible with the
remote system's selection was found: 'aes128-ctr,aes192-ctr,aes256-
ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-
poly1305@openssh.com'

box5: kodi
Code: Pascal  [Select][+][-]window.onload = function(){var x1 =
document.getElementById("main_content_section"); if (x1) { var x =
document.getElementsByClassName("geshi");for (var i = 0; i LibreSSL
2.2.6Error: Error connecting to SSH server kodi:22 as user root.
Technical details: No algorithm compatible with the remote system's
selection was found: 'chacha20-poly1305@openssh.com,aes128-ctr,aes192-
ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com'

----------------------------------------------------------------------
Thaddy · 2016-10-08 05:38

The servers do not recognize the protocols.
The openssl one really needs updating.
On ubunto do sudo apt-get update suso apt-get upgrade
You really need to update your encryption libraries.
I can not help you in any meaningful way if you don't update.
You also need to update libressl to 2.4.3.

After that we can take the next step.

Except maybe for the really old openssl versions from 2008 and 2009
your package manager should install a version that is up to date since
security packages are often back-ported.
Even if it is an otherwise non-maintained distribution!
The openssl version number should be 1.0.0t or higher.

The reason being that many protocols have been added and some
protocols are disabled or removed for security reasons.

Also note you have only one of the four boxes correctly configured:
the one that drops the connection without answer.
First update. The latter will come later.

----------------------------------------------------------------------
Pascal · 2016-10-08 06:10

Quote from: Thaddy on October 08, 2016, 07:38:17 amOn ubunto do sudo
apt-get update sudo apt-get upgradeI did but openssl version is still
the same :-(

----------------------------------------------------------------------
Pascal · 2016-10-08 06:17

But why is putty able to connect to these machines without any
problems?

----------------------------------------------------------------------
Thaddy · 2016-10-08 09:28

PuTTy uses its own non-standard type of certicicate, although the
handshake is standard.
Are you by any chance using PuTTy's certificates? Then that may be the
cause. SSH <> PuTTy in this case.
I am pretty sure we narrowed it down to a certificate issue as the
main culprit.

See https://help.ubuntu.com/community/SSH/OpenSSH/Keys

Since you are using very old encryption on at least three of those
boxes don't choose a keylength of 2048 or 4096 at first. First try
1024, the try with 2048 and hopefully 4096 will also work on your
servers.

----------------------------------------------------------------------
Pascal · 2016-10-08 10:34

Quote from: Thaddy on October 08, 2016, 11:28:57 amSince you are using
very old encryption on at least three of those boxes don't choose a
keylength of 2048 or 4096 at first. First try 1024, the try with 2048
and hopefully 4096 will also work on your servers.
How can i do this with the sample code/synapse?
Sorry, but i do not have any knowledge of using SSH, SSL and
encryption!

----------------------------------------------------------------------
Pascal · 2016-10-09 06:31

Quote from: Thaddy on October 08, 2016, 11:28:57 amAre you by any
chance using PuTTy's certificates? Then that may be the cause.
No, as i installed putty a while after i tried to connect to those
linux boxes (at least at home).

----------------------------------------------------------------------
Thaddy · 2016-10-09 08:22

Follow these instructions.
https://www.digitalocean.com/community/tutorials/how-to-set-up-ssh-
keys--2

Then run the example from the wiki:
http://wiki.lazarus.freepascal.org/Synapse#SSH.2FTelnet_client_sample_
program

----------------------------------------------------------------------
Pascal · 2016-10-10 04:17

Didn't work:
Error connecting to SSH server kodi:22 as user root. Technical
details:
Error connecting to SSH server ubuntuserver:22 as user pascal.
Technical details:


Can anybody connect to SSH servers on linux machines using synapse, or
any other pascal source code?

----------------------------------------------------------------------
Thaddy · 2016-10-10 04:41

Yes I can. I do it on a daily basis. The example works, afaik. I use a
slightly different one but the wiki example works if all requirements
are properly installed.

----------------------------------------------------------------------
Pascal · 2016-10-10 05:51

Do you use cryptlib or openssl? And do you connect from Windows?

If you use openssl on windows, can you send me your bindings and dlls?

----------------------------------------------------------------------
rvk · 2016-10-10 09:14

@Pascal, what version of Synapse did you use?
You should use the SVN version and not the stable release no. 40.

----------------------------------------------------------------------
Thaddy · 2016-10-10 09:20

Get it here https://sourceforge.net/p/synalist/code/HEAD/tree/trunk/
download snapshot

or if you have svn installed:
svn co https://svn.code.sf.net/p/synalist/code/trunk synapsetrunk

----------------------------------------------------------------------
Pascal · 2016-10-10 09:34

I already use the svn trunk version!

----------------------------------------------------------------------
Thaddy · 2016-10-10 10:45

In this case did you really, really, honestly follow up on my
instructions because I am unable to replicate the issue on multiple
server platforms.

I tested armhf client to windows server. armhf client to armhf server.
armhf client to linux x86_64 server, linux-x86_64 client to
linux-x86_64 server windows 10-64 to linuxx86_64 server and they all
work with the example code and properly installed certificates. See
the link on how to do that and do not out-smart those instructions.

I can't help more than I did. Simply put: I spend hours on it and
can't replicate it.

Note I have synapse SSH code using openssl running in production code
for high-level clients. I mean top 500 banks. Many people here know
that.

----------------------------------------------------------------------
Pascal · 2016-10-10 10:54

Yes i did!
Maybe the problem is that you use ssl_libssh2 and i use ssl_cryptlib!
Could this be the issue here?


Just did it again at work:

Connected to the aix machine as sg32, generated a key, put key to
d197@suselinux02
Code: Pascal  [Select][+][-]window.onload = function(){var x1 =
document.getElementById("main_content_section"); if (x1) { var x =
document.getElementsByClassName("geshi");for (var i = 0; i login as:
sg32sg32@suseaix's password:Letzte nicht erfolgreiche Anmeldung: Mo  5
Sep 13:13:19 2016 an ssh von w8-xxxxx.susdom.localLetzte Anmeldung: Mo
10 Okt 12:46:49 2016 an /dev/pts/2 von w8-
xxxxxx.susdom.local***************************************************
*****************************                                        
                                   **                                
                                           **  Welcome to AIX Version
7.1!                                                **               
                                                            **       
                                                                    **
 Please see the README file in /usr/lpp/bos for information pertinent
to    **  this release of the AIX Operating System.                  
              **                                                     
                      **                                             
                              ****************************************
****************************************suseaix.[sg32]:/sourcen/sg32
ssh-keygen -t rsaGenerating public/private rsa key pair.Enter file in
which to save the key (/sourcen/sg32/.ssh/id_rsa):Enter passphrase
(empty for no passphrase):Enter same passphrase again:Your
identification has been saved in /sourcen/sg32/.ssh/id_rsa.Your public
key has been saved in /sourcen/sg32/.ssh/id_rsa.pub.The key
fingerprint is:20:6c:dc:5d:2e:6e:7f:62:6c:0e:c2:65:d7:84:e2:15
sg32@suseaixThe key's randomart image is:+--[ RSA 2048]----+|        
 E      ||   o . . o o     ||    = o + + .    ||   . . + + o     ||  
    S . .    ||     . + +       ||      o . * .    ||       . = o    
||          .      |+-----------------+suseaix.[sg32]:/sourcen/sg32
ssh-copy-id d197@suselinux02ssh-copy-id: Command not
found.suseaix.[sg32]:/sourcen/sg32 cat ~/.ssh/id_rsa.pub | ssh
d197@suselinux02 "mkdir -p ~/.ssh && cat >>
 ~/.ssh/authorized_keys"The authenticity of host 'suselinux02
(192.168.205.50)' can't be established.ECDSA key fingerprint is
31:c2:61:d6:86:b1:33:5b:e2:03:b6:0a:45:3a:b5:6f.Are you sure you want
to continue connecting (yes/no)? yesWarning: Permanently added
'suselinux02,192.168.205.50' (ECDSA) to the list of known
hosts.pam_mount password:suseaix.[sg32]:/sourcen/sg32
copied the key to my project path and ran the code:
Code: Pascal  [Select][+][-]window.onload = function(){var x1 =
document.getElementById("main_content_section"); if (x1) { var x =
document.getElementsByClassName("geshi");for (var i = 0; i program
TestSSHClient; {Test program for telnetsshclient Written by Reinier
Olislagers 2011.Modified for libssh2 by Alexey Suhinin 2012. License
of code:* MIT* LGPLv2 or later (with FreePascal static linking
exception)* GPLv2 or lateraccording to your choice.Free use allowed
but please don't sue or blame me. Uses other libraries/components;
different licenses may apply that also can influence the
combined/compiled work. Run: sshtest <serverIPorhostname>
[PrivateKeyFile]}{$mode objfpc}{$H+}{$APPTYPE CONSOLE} uses 
telnetsshclient;var  comm: TTelnetSSHClient;  Command: string;begin 
writeln('Starting.');  comm:=TTelnetSSHClient.Create;  comm.HostName:=
'suselinux02'; // ParamStr(1); //First argument on command line  if
comm.HostName='' then  begin    writeln('Please specify hostname on
command line.');    halt(1);  end;   //comm.PrivateKeyFile :=
'C:\freepascal\projects\SSH-Test2\id_rsa';  comm.PrivateKeyFile :=
'id_rsa';   comm.TargetPort:=''; //auto determine based on
protocoltype  comm.UserName:='d197'; //change to your situation 
comm.Password:=''; //change to your situation  comm.ProtocolType:=SSH;
//Telnet or SSH  //comm.Sock.SSL.Ciphers := 'chacha20-
poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-
gcm@openssh.com,aes256-gcm@openssh.com';  writeln(comm.Connect);
//Show result of connection  if comm.Connected then  begin   
writeln('Server: ' + comm.HostName + ':'+comm.TargetPort+', user:
'+comm.UserName);    writeln('Welcome message:');   
writeln(comm.WelcomeMessage);    Command:='ls -al';    writeln('***
Sending ' + Command);    writeln('*** Begin result****');   
writeln(comm.CommandResult(Command));    writeln('*** End
result****');    writeln('');    writeln('');    Command:='df -h';   
writeln('*** Sending ' + Command);    writeln('*** Begin
result****');    writeln(comm.CommandResult(Command));    writeln('***
End result****');    writeln('');    writeln('');    writeln('All
output:');    writeln('*** Begin result****');   
writeln(comm.AllOutput);    writeln('*** End result****');   
comm.Disconnect;  end  else  begin    writeln('Connection to ' +     
comm.HostName + ':' +      comm.TargetPort + ' failed.');  end; 
comm.Free;end.
Same result: Code: Pascal  [Select][+][-]window.onload =
function(){var x1 = document.getElementById("main_content_section");
if (x1) { var x = document.getElementsByClassName("geshi");for (var i
= 0; i Starting.Error connecting to SSH server suselinux02:22 as user
d197. Technical details:Connection to suselinux02:22 failed.

----------------------------------------------------------------------
Thaddy · 2016-10-10 11:13

I never used cryptlib. In the wild. The standard is openssl. That is
known to work.

----------------------------------------------------------------------
Pascal · 2016-10-10 11:14

So maybe you can send me your dlls and bindings for ssh2 and openssl?

----------------------------------------------------------------------
rvk · 2016-10-10 11:22

What's in your /var/log/auth.log on your linux-box.

I also couldn't get libssh2 to work.
got
Code: [Select]Accepted publickey for root from 10.211.62.31 port 50699
ssh2: RSA xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx
sshd[24738]: pam_unix(sshd:session): session opened for user root by
(uid=0)
sshd[24738]: pam_unix(sshd:session): session closed for user rootThe
connect works but somehow fails at FSock.SSLDoConnect.
Not sure if I got the correct libssh2.dll and libssh2.pas though.

----------------------------------------------------------------------
Pascal · 2016-10-10 11:27

I do not have  /var/log/auth.log on this machine.

----------------------------------------------------------------------
rvk · 2016-10-10 11:29

Quote from: Pascal on October 10, 2016, 01:27:27 pmI do not have 
/var/log/auth.log on this machine.
Where does your machine log the pam_unix/sshd messages?

Maybe in /var/log/secure or /var/log/messages?

----------------------------------------------------------------------
Pascal · 2016-10-10 11:31

/var/log/messages i think but i have no access to this file

----------------------------------------------------------------------
Pascal · 2016-10-10 11:42

I just did a test with some old ssh2 dlls i've found:
Error: Error connecting to SSH server suselinux02:22 as user d197.
Technical details: Unable to open public key file

Where to place the public key file? Which one mine or of
d197@suselinux02?

----------------------------------------------------------------------
Pascal · 2016-10-10 12:52

Just added PublicKeyFile to synapse ssl plugin and supplied my public
keyfile and voila:
Code: Pascal  [Select][+][-]window.onload = function(){var x1 =
document.getElementById("main_content_section"); if (x1) { var x =
document.getElementsByClassName("geshi");for (var i = 0; i
Starting.Connected to SSH server.Server: suselinux02:22, user:
d197Welcome message:Last login: Mon Oct 10 13:24:47 2016 from
w8-xxxxxsuselinux02.[d197]:/sus/sg32/d197*** Sending ls -al*** Begin
result****ls -alinsgesamt 114484drwxr-xr-x 35 d197 suslibma     4096
10. Okt 14:31*** End result****  *** Sending df -h*** Begin
result**** .drwxr-xr-x 12 root suslibma     4096  2. Mai 14:02
..drwxr-xr-x  6 d197 suslibma     4096  2. Jun*** End result****  All
output:*** Begin result****Last login: Mon Oct 10 13:24:47 2016 from
w8-xxxxxsuselinux02.[d197]:/sus/sg32/d197 ls -alinsgesamt 114484drwxr-
xr-x 35 d197 suslibma     4096 10. Okt 14:31 .drwxr-xr-x 12 root
suslibma     4096  2. Mai 14:02 ..drwxr-xr-x  6 d197 suslibma     4096
 2. Jun*** End result****
ReceiveData doesn't wait long enough to get full output.

----------------------------------------------------------------------
rvk · 2016-10-10 12:54

Quote from: Pascal on October 10, 2016, 02:52:48 pmJust added
PublicKeyFile to synapse ssl plugin and supplied my public keyfile and
voila:
How did you do that?

Where did you supply the public keyfile in synapse?

----------------------------------------------------------------------
Thaddy · 2016-10-10 12:56

Quote from: rvk on October 10, 2016, 02:54:52 pmQuote from: Pascal on
October 10, 2016, 02:52:48 pmJust added PublicKeyFile to synapse ssl
plugin and supplied my public keyfile and voila:
How did you do that?

Where did you supply the public keyfile in synapse?

Yup.I wonder. It should be the private key and the public key should
reside on the server....
Citing from the digitalocean link I gave you:
"Step Three—Copy the Public Key

Once the key pair is generated, it's time to place the public key on
the virtual server that we want to use."

Did you do it the other way around?

----------------------------------------------------------------------
Pascal · 2016-10-10 13:43

Quote from: Thaddy on October 10, 2016, 02:56:43 pmQuote from: rvk on
October 10, 2016, 02:54:52 pmQuote from: Pascal on October 10, 2016,
02:52:48 pmJust added PublicKeyFile to synapse ssl plugin and supplied
my public keyfile and voila:
How did you do that?

Where did you supply the public keyfile in synapse?

Yup.I wonder. It should be the private key and the public key should
reside on the server....
Citing from the digitalocean link I gave you:
"Step Three—Copy the Public Key

Once the key pair is generated, it's time to place the public key on
the virtual server that we want to use."

Did you do it the other way around?

See this post: https://curl.haxx.se/mail/archive-2012-04/0059.html
Code: Pascal  [Select][+][-]window.onload = function(){var x1 =
document.getElementById("main_content_section"); if (x1) { var x =
document.getElementsByClassName("geshi");for (var i = 0; i Nowadays
libssh2 only requires both if built against gcrypt instead ofOpenSSL.
My version of ssh2 is build againt gcrypt. So i had to add the
publickeyfile to the call to libssh2_userauth_publickey_fromfile
Code: Pascal  [Select][+][-]window.onload = function(){var x1 =
document.getElementById("main_content_section"); if (x1) { var x =
document.getElementsByClassName("geshi");for (var i = 0; i function
IfThen(cond: Boolean; val1, val2: PChar): PChar;begin  if cond then  
Result := val1  else    Result := val2;end; ... function
TSSLLibSSH2.Connect: boolean;begin      ...      if
(FSocket.SSL.PublicKeyFile<>'') then        if (not
SSHCheck(libssh2_userauth_publickey_fromfile(FSession,
PChar(FSocket.SSL.Username), IfThen(FSocket.SSL.PrivateKeyFile='',
nil, PChar(FSocket.SSL.PublicKeyFile)),
PChar(FSocket.SSL.PrivateKeyFile), PChar(FSocket.SSL.KeyPassword)))) 
     ...                                                             
                          ^^^^^^^^^^^^end;
I also added prperty PublicKeyFile to the ssl plugin and to
TTelnetSSHClient.

----------------------------------------------------------------------
Pascal · 2016-10-10 13:57

Anyway, is there a place where to find current ssh2 and openssl dlls
and maybe also pascal bindings?
Thaddy can you provide yours?

----------------------------------------------------------------------
Thaddy · 2016-10-10 15:22

At the source:

https://wiki.openssl.org/index.php/Binaries

I use the ones from fulgan.com
pascal headers come standard with fpc.
libssh2 headers should be from https://github.com/libssh2/libssh2

This whole story makes me very cautious regarding using gcrypt.
Do they really claim server and client cert should be on the same
place?
Or one can be omitted?

That is ridiculous. That is not crypto-safe by definition.
As think libressl and openssl.

----------------------------------------------------------------------
rvk · 2016-10-10 15:39

Quote from: Thaddy on October 10, 2016, 05:22:48 pmAt the source:
https://wiki.openssl.org/index.php/Binaries
I use the ones from fulgan.com
pascal headers come standard with fpc.
Thaddy, in that case you didn't use libssh2.dll, did you?

The question was, could you provide your libssh2.dll and corresponging
libssh2.pas which are missing from Synapse. Synapse doesn't support
direct SSH2 via ssl_openssl.pas. If you did it without libssh2.pas or
cryptlib.pas, we love to know how you did it.

----------------------------------------------------------------------
Pascal · 2016-10-10 15:44

Yes, that would have been my next question:
What about libssh2?

----------------------------------------------------------------------
Pascal · 2016-10-10 20:48

Unit ssl_libssh2 has a bug. That's why username/password login doesn't
work.

Code: Pascal  [Select][+][-]window.onload = function(){var x1 =
document.getElementById("main_content_section"); if (x1) { var x =
document.getElementsByClassName("geshi");for (var i = 0; i function
TSSLLibSSH2.Connect: boolean;begin  Result := False;  if SSLEnabled
then DeInit;  if (FSocket.Socket <> INVALID_SOCKET) and
(FSocket.SSL.SSLType = LT_SSHv2) then    begin      FSession :=
libssh2_session_init();      if not Assigned(FSession) then     
begin        FLastError := -999;        FLastErrorDesc := 'Cannot
initialize SSH session';        exit;      end;      if not
SSHCheck(libssh2_session_startup(FSession, FSocket.Socket)) then     
 exit;      // Attempt private key authentication, then fall back to
username/password but      // do not forget original private key auth
error. This avoids giving spurious errors like      // Authentication
failed (username/password)      // instead of e.g.      // Unable to
extract public key from private key file: Method unimplemented in
libgcrypt backend      //>>>>>      //if
(FSocket.SSL.PublicKeyFile<>'') then   <<<<<<<<<<<<<<<<<<<<<<<<<<<
disable this line an it works      //<<<<<        if (not
SSHCheck(libssh2_userauth_publickey_fromfile(FSession,
PChar(FSocket.SSL.Username), IfThen(FSocket.SSL.PrivateKeyFile='',
nil, PChar(FSocket.SSL.PublicKeyFile)),
PChar(FSocket.SSL.PrivateKeyFile), PChar(FSocket.SSL.KeyPassword)))) 
       and (libssh2_userauth_password(FSession,
PChar(FSocket.SSL.Username), PChar(FSocket.SSL.Password))<0) then    
      exit;      FChannel := libssh2_channel_open_session(FSession); 
   if not assigned(FChannel) then      begin//        SSHCheck(-1);  
    FLastError:=-999;        FLastErrorDesc := 'Cannot open session'; 
      exit;      end;      if not
SSHCheck(libssh2_channel_request_pty(FChannel, 'vanilla')) then      
exit;      if not SSHCheck(libssh2_channel_shell(FChannel)) then     
 exit;      FSSLEnabled := True;      Result := True;    end;end; 
Disable the mentioned line and it will work with username and
password.

----------------------------------------------------------------------
Pascal · 2016-10-11 07:55

Strange: While authentikation with username and password works at home
for my 2 machines,
it doesn't work at work: Authentication failed (username/password)

----------------------------------------------------------------------
rvk · 2016-10-11 08:16

Yeah, that small piece of code isn't really practical programming. The
first "if" should indeed be removed. But after that the
libssh2_userauth_publickey_fromfile() is always executed even if no
file was presented. It should fall through to
libssh2_userauth_password() but still doesn't work correctly. I would
prefer to only do libssh2_userauth_publickey_fromfile() when there is
a PrivateKeyFile and libssh2_userauth_password() otherwise.

Something like this:
Code: Pascal  [Select][+][-]window.onload = function(){var x1 =
document.getElementById("main_content_section"); if (x1) { var x =
document.getElementsByClassName("geshi");for (var i = 0; i       if
FSocket.SSL.PrivateKeyFile<>'' then      begin        if (not
SSHCheck(libssh2_userauth_publickey_fromfile(FSession,
PChar(FSocket.SSL.Username),            nil,           
PChar(FSocket.SSL.PrivateKeyFile), PChar(FSocket.SSL.KeyPassword))))
then exit;      end      else      begin        if
(libssh2_userauth_password(FSession, PChar(FSocket.SSL.Username),
PChar(FSocket.SSL.Password))<0) then          exit;      end;
That does allow me to connect with just a username and password.
Unfortunately I get a "Channel open failure"  (10091) in both cases.
But the connect works.

Actually... libssh2_userauth_password() should also have a SSHCheck()
around it:

Code: Pascal  [Select][+][-]window.onload = function(){var x1 =
document.getElementById("main_content_section"); if (x1) { var x =
document.getElementsByClassName("geshi");for (var i = 0; i       if
FSocket.SSL.PrivateKeyFile<>'' then      begin        if not
SSHCheck(libssh2_userauth_publickey_fromfile(FSession,
PChar(FSocket.SSL.Username), nil,           
PChar(FSocket.SSL.PrivateKeyFile), PChar(FSocket.SSL.KeyPassword)))
then exit;      end      else      begin        if not
SSHCheck(libssh2_userauth_password(FSession,
PChar(FSocket.SSL.Username), PChar(FSocket.SSL.Password))) then      
  exit;      end;

----------------------------------------------------------------------
Pascal · 2016-10-11 09:21

Yes, you are right. Corrected in wiki already.

----------------------------------------------------------------------
rvk · 2016-10-11 09:30

I'm wondering why the SSHCheck(-1); is commented out after the
libssh2_channel_open_session(). For me that check was the only way to
know why I kept getting a 'Cannot open session'. (It was actually a 
"Channel open failure"  (10091))

Unless FChannel can be unassigned and libssh2_session_last_error()
still return no error.
In which case I would do it like this:
Code: Pascal  [Select][+][-]window.onload = function(){var x1 =
document.getElementById("main_content_section"); if (x1) { var x =
document.getElementsByClassName("geshi");for (var i = 0; i      
FChannel := libssh2_channel_open_session(FSession);      if not
assigned(FChannel) then      begin        SSHCheck(-1); // get error 
     if FLastError = 0 then        begin          FLastError := -999;
// unknown error          FLastErrorDesc := 'Cannot open session';   
   end;        exit;      end;

----------------------------------------------------------------------
Pascal · 2016-10-11 09:38

Yes, good, should work!

----------------------------------------------------------------------
rvk · 2016-10-11 09:46

Ok, I changed it.
What versions of the libssh2.dll (and openssl) are you using?

(still having the "channel open failure" problem)

----------------------------------------------------------------------
Pascal · 2016-10-11 10:01

My version of libssh2 doesn't use openssl. It uses libgcrypt. I can
not determine the version.

----------------------------------------------------------------------
Pascal · 2016-10-11 11:12

@Thaddy: Many thanks for your help finding the problem. I wouldn't
have been so far without you!

Last remainig issue: Where do i get the latest libssh2 binaries and
openssl binaries (without compiling them myself)?

----------------------------------------------------------------------
Pascal · 2016-10-19 07:45

Quote from: Pascal on October 11, 2016, 01:12:45 pmLast remainig
issue: Where do i get the latest libssh2 binaries and openssl binaries
(without compiling them myself)?
Is this realy true, that no one knows where ro get compiled binaries
for these dlls?

----------------------------------------------------------------------
rvk · 2016-10-19 08:03

Quote from: Pascal on October 19, 2016, 09:45:07 amQuote from: Pascal
on October 11, 2016, 01:12:45 pmLast remainig issue: Where do i get
the latest libssh2 binaries and openssl binaries (without compiling
them myself)?
Is this realy true, that no one knows where ro get compiled binaries
for these dlls?
The locations of the openssl binaries is already mentioned:
https://indy.fulgan.com/SSL/
The libssh2 is somewhat more difficult to find. You can extract them
from a PHP-installation or other source. But the corresponding header-
file for pascal is even more difficult to find. I'm not aware of any
official releases for them.

----------------------------------------------------------------------
Thaddy · 2016-10-19 08:16

FYI: I am in the process of fixing issues with current outdated
openssl.pas and will amend the wiki accordingly. My example should
still work as advertised.

----------------------------------------------------------------------
Pascal · 2016-10-19 14:13

Quote from: rvk on October 19, 2016, 10:03:31 amThe locations of the
openssl binaries is already mentioned:
https://indy.fulgan.com/SSL/Okay. Last time i had a look there i
thought they were outdated.

----------------------------------------------------------------------
Pascal · 2016-10-19 14:14

Quote from: Thaddy on October 19, 2016, 10:16:53 amFYI: I am in the
process of fixing issues with current outdated openssl.pas and will
amend the wiki accordingly. My example should still work as
advertised.Great

----------------------------------------------------------------------
big_M · 2017-04-13 23:41

Since I only found this thread when googling for "Technical details:
No algorithm compatible with the remote system's selection was found:"
...

There seems to be problem with openssh 6.7 upwards and cryptlib 3.4.2.

http://forums.apc.com/spaces/7/ups-management-devices-powerchute-
software/forums/general/1785/openssh-v6-7-received-disconnect-
handshake-failed/1#6079

My program used to work perfectly using synapse and cryptlib to
connect to an ssh server, until I upgraded my Linux distribution.
Reverting back to openssh 6.6 solved the problem for now. Maybe this
info will be usefull to someone

----------------------------------------------------------------------
Thaddy · 2017-04-14 04:30

"The probably easies workaround for now is to force the use of MD5 to
make SSH request only a 3076 bit DH key.

This can be done using the "-m hmac-md5" command line flag or "MACs
hmac-md5" config option."

WTF? Chillingly bad advice. Don't use that.