Bug 368

Summary: TTSSH will not connect to OpenSSH_3.4p1
Product: Portable OpenSSH Reporter: Ari Gordon-Schlosberg <mindrot>
Component: sshdAssignee: OpenSSH Bugzilla mailing list <openssh-bugs>
Status: CLOSED WORKSFORME    
Severity: normal CC: mindrot
Priority: P2    
Version: -current   
Hardware: ix86   
OS: NetBSD   
Attachments:
Description Flags
Patch to add pid to logs none

Description Ari Gordon-Schlosberg 2002-07-24 12:12:30 AEST 
The popular TeraTerm TTSSH ssh client is having problems connecting to sshd.  

TTSSH will throw a dialog box with the message:

"Detected corrupted data; connection terminating."

"Detected corrupted data; connection terminating."

... and then exit. Pretty annoying.

Here's debugging output:

debug1: sshd version OpenSSH_3.4p1
debug1: private host key: #0 type 0 RSA1
debug3: Not a RSA1 key file /usr/pkg/etc/ssh/ssh_host_rsa_key.
debug1: read PEM private key done: type RSA
debug1: private host key: #1 type 1 RSA
debug3: Not a RSA1 key file /usr/pkg/etc/ssh/ssh_host_dsa_key.
debug1: read PEM private key done: type DSA
debug1: private host key: #2 type 2 DSA
debug1: Bind to port 2222 on ::.
Server listening on :: port 2222.
debug1: Bind to port 2222 on 0.0.0.0.
Server listening on 0.0.0.0 port 2222.
Generating 768 bit RSA key.
RSA key generation complete.
debug1: Server will not fork when running in debugging mode.
Connection from 192.168.0.4 port 4910
debug1: Client protocol version 1.5; client software version TTSSH/1.5.4 Win32
debug1: no match: TTSSH/1.5.4 Win32
debug1: Local version string SSH-1.99-OpenSSH_3.4p1
debug2: Network child is on pid 18843
debug3: preauth child monitor started
debug3: mm_request_receive entering
debug3: privsep user:group 16:16
debug1: Sent 768 bit server key and 1024 bit host key.
debug1: Encryption type: blowfish
debug3: mm_request_send entering: type 28
debug3: monitor_read: checking request 28
debug3: mm_request_receive_expect entering: type 29
debug3: mm_request_receive entering
debug3: mm_request_send entering: type 29
debug3: mm_ssh1_session_id entering
debug3: mm_request_send entering: type 30
debug1: Received session key; encryption turned on.
debug2: monitor_read: 28 used once, disabling now
debug3: mm_request_receive entering
debug3: monitor_read: checking request 30
debug3: mm_answer_sessid entering
debug2: monitor_read: 30 used once, disabling now
debug3: mm_request_receive entering
debug1: Installing crc compensation attack detector.
Disconnecting: Corrupted check bytes on input.
debug1: Calling cleanup 0x80678c0(0x0)
debug1: Calling cleanup 0x80678c0(0x0)

The machine running it: 

regs@vietnam|~% uname -a
NetBSD vietnam.doof.nebcorp.com 1.5.2 NetBSD 1.5.2 (GENERIC) #3: Sat Aug 18 
23:37:05 CEST 2001     
he@hamster.urc.uninett.no:/usr/src/sys/arch/i386/compile/GENERIC i386


And an OpenBSD machine running the non-portable server works fine:

debug1: sshd version OpenSSH_3.4
debug1: private host key: #0 type 0 RSA1
debug3: Not a RSA1 key file /etc/ssh/ssh_host_rsa_key.
debug1: read PEM private key done: type RSA
debug1: private host key: #1 type 1 RSA
debug3: Not a RSA1 key file /etc/ssh/ssh_host_dsa_key.
debug1: read PEM private key done: type DSA
debug1: private host key: #2 type 2 DSA
debug1: Bind to port 2222 on ::.
Server listening on :: port 2222.
debug1: Bind to port 2222 on 0.0.0.0.
Server listening on 0.0.0.0 port 2222.
Generating 768 bit RSA key.
RSA key generation complete.
debug1: Server will not fork when running in debugging mode.
Connection from 64.81.49.197 port 57869
debug1: Client protocol version 1.5; client software version TTSSH/1.5.4 Win32
debug1: no match: TTSSH/1.5.4 Win32
debug1: Local version string SSH-1.99-OpenSSH_3.4
debug2: Network child is on pid 29316
debug3: preauth child monitor started
debug3: mm_request_receive entering
debug3: privsep user:group 32767:32767
debug1: Sent 768 bit server key and 1024 bit host key.
debug1: Encryption type: blowfish
debug3: mm_request_send entering: type 28
debug3: monitor_read: checking request 28
debug3: mm_request_receive_expect entering: type 29
debug3: mm_request_receive entering
debug3: mm_request_send entering: type 29
debug3: mm_ssh1_session_id entering
debug3: mm_request_send entering: type 30
debug1: Received session key; encryption turned on.
debug2: monitor_read: 28 used once, disabling now
debug3: mm_request_receive entering
debug3: monitor_read: checking request 30
debug3: mm_answer_sessid entering
debug2: monitor_read: 30 used once, disabling now
debug3: mm_request_receive entering
debug1: Installing crc compensation attack detector.
debug3: mm_getpwnamallow entering
debug3: mm_request_send entering: type 6
debug3: monitor_read: checking request 6
debug3: mm_answer_pwnamallow
debug3: mm_answer_pwnamallow: sending MONITOR_ANS_PWNAM: 1
debug3: mm_request_send entering: type 7
...

Any ideas?
Comment 1 Ari Gordon-Schlosberg 2002-07-24 12:16:54 AEST 
Just make life easier:

TeraTerm 2.3
http://hp.vector.co.jp/authors/VA002416/ttermp23.zip

TTSSH 1.5.4 plugin
http://www.cs.cmu.edu/~roc/ttssh154.zip
Comment 2 Markus Friedl 2002-07-25 20:04:34 AEST 
it looks like the monitor process is sending data over
the network.

you could change packet.c to printout
the current pid and the packet type for every packet sent.

the monitor process is not allowed to call
packet_send.
Comment 3 Joe Doyle 2002-08-06 12:29:42 AEST 
This occurs when using the blowfish cypher (see the ttssh debug output) with the openssh 
3.4 client on a FreeBSD 4.4 machine, linked against openssl 0.9.6e.  It does not occur when 
using the default 3DES cypher.
Comment 4 Damien Miller 2002-09-10 21:52:37 AEST 
Created attachment 143 [details]
Patch to add pid to logs

This is a quick patch to display the pid of the logging process. It may be
helpful in debugging privsep problems.
Comment 5 Damien Miller 2003-05-14 22:59:22 AEST 
Please retest with a recent release, some of the older releases had OpenSSL issues.
Comment 6 Darren Tucker 2003-08-26 17:40:26 AEST 
Just tried this with OpenSSH -current linked against OpenSSL 0.9.7b (using
blowfish cipher) and it worked OK.  Please re-open if you can reproduce with
current OpenSSH and OpenSSL versions.
Comment 7 Damien Miller 2004-04-14 12:24:18 AEST 
Mass change of RESOLVED bugs to CLOSED