SSH2DOS - Updated for 2021 standards \ VOGONS

SSH2DOS - Updated for 2021 standards

Topic actions

Post a reply

First post, by fragmentfi

Posted on 2021-04-14, 18:40

fragmentfi Offline

Rank Newbie

Rank: Newbie
Posts: 5
Joined: 2017-03-01, 08:22
Location: Finland

The original SSH2DOS was last updated in 2006 and the protocols and ciphers it uses are outdated and basically it does not work anymore. I've patched the program to be up to date (as of 2021).

The old programs can be still used if the ssh server configuration is changed to allow using less secure connection methods. The patched ones have been tested with the latest Ubuntu (20.04.2 LTS) release and needs to changes to ssh server configuration.

Old protocols and ciphers have been replaced as follows:
diffie-hellman-group1-sha1 -> diffie-hellman-group14-sha256
aes128-cbc -> aes128-ctr
hmac-sha1 -> hmac-sha2-256

I have only tested ssh and scp clients with password authentication. Key based authentication is most likely broken and needs some more work. Other changes to the program are minimal, the goal was just to get it working again with minimum effort.

I'm open for comments, bug reports and improvement ideas!

Source and binaries are available on GitHub:
https://github.com/AnttiTakala/SSH2DOS/

Reply 1 of 10, by kdr

Posted on 2021-04-14, 22:29

kdr Offline

Rank Member

Rank: Member
Posts: 129
Joined: 2020-09-20, 12:40
Location: New Zealand

Great work! It'll be nice to have a working SSH client for my systems without mucking around in sshd_config on all the servers...

Reply 2 of 10, by keenmaster486

Posted on 2021-04-14, 23:24

keenmaster486 Offline

Rank l33t

Rank: l33t
Posts: 2296
Joined: 2016-02-16, 02:04
Location: Atroxus

Yooooooooo thank you! Been hoping someone would do this!

I flermmed the plootash just like you asked.
World's foremost 486 enjoyer.

Reply 3 of 10, by mr.cat

Posted on 2021-04-15, 09:13

mr.cat Offline

Rank Member

Rank: Member
Posts: 310
Joined: 2020-12-13, 11:56
Location: Finland

Tervehdys Antti 😁

I'm not a DOS user but got curious: What are these DOS versions using as an entropy source?
There is no /dev/random for DOS is there? I know in some other systems there are separate entropy daemons used, and they need to be configured by the user.

Reply 4 of 10, by fragmentfi

Posted on 2021-04-15, 10:21

fragmentfi Offline

Rank Newbie

Rank: Newbie
Posts: 5
Joined: 2017-03-01, 08:22
Location: Finland

Good question. The original implementation only uses rand() for randomness so it really isn't cryptographically secure at all. This could be addressed in the future but I wouldn't be surprised if the implementation has other potential security issues. On the other hand I would not use DOS based systems or programs for anything serious anyway 😁

Reply 5 of 10, by mr.cat

Posted on 2021-04-15, 10:28

mr.cat Offline

Rank Member

Rank: Member
Posts: 310
Joined: 2020-12-13, 11:56
Location: Finland

Thanks, that's pretty much what I suspected. You're right it's more of a convenience to provide connectivity to modern machines, not really for security.
Hopefully the potential users are aware of that.

Anyways, nice to see that even the humble ole DOS hasn't been left behind 😁

Reply 6 of 10, by Hojo82

Posted on 2021-04-15, 11:51

Hojo82 Offline

Rank Newbie

Rank: Newbie
Posts: 18
Joined: 2021-01-03, 17:26

This is awesome! I got bitten by the old cipher issue in the past couple of months, so this is a welcome update! 👍

Reply 7 of 10, by fragmentfi

Posted on 2021-04-15, 16:38

fragmentfi Offline

Rank Newbie

Rank: Newbie
Posts: 5
Joined: 2017-03-01, 08:22
Location: Finland

There is now a release package on GitHub for the initial release.

Something to note: the non-386 versions are slow. The process between starting the program and prompting for a password takes 11 seconds on my 266MHz Pentium II when connecting to a machine in the same network. For the 386 version it takes only about one second. As I currently only have Pentium class DOS machines, I'd be interested hearing some feedback and test results from slower machines.

Reply 8 of 10, by keenmaster486

Posted on 2021-04-15, 16:52

keenmaster486 Offline

Rank l33t

Rank: l33t
Posts: 2296
Joined: 2016-02-16, 02:04
Location: Atroxus

fragmentfi wrote on 2021-04-15, 16:38:

There is now a release package on GitHub for the initial release.

Something to note: the non-386 versions are slow. The process between starting the program and prompting for a password takes 11 seconds on my 266MHz Pentium II when connecting to a machine in the same network. For the 386 version it takes only about one second. As I currently only have Pentium class DOS machines, I'd be interested hearing some feedback and test results from slower machines.

I can attempt this later today on my 286.

I flermmed the plootash just like you asked.
World's foremost 486 enjoyer.

Reply 9 of 10, by Stiletto

Posted on 2021-04-19, 05:59

Stiletto Offline

Rank l33t

Rank: l33t
Posts: 4950
Joined: 2002-07-01, 21:57

fragmentfi wrote on 2021-04-15, 10:21:

Good question. The original implementation only uses rand() for randomness so it really isn't cryptographically secure at all. This could be addressed in the future but I wouldn't be surprised if the implementation has other potential security issues. On the other hand I would not use DOS based systems or programs for anything serious anyway 😁

Time for the return of the lava lamp entropy generator? 😁

"I see a little silhouette-o of a man, Scaramouche, Scaramouche, will you
do the Fandango!" - Queen

Stiletto

Reply 10 of 10, by Axatax

Posted on 2021-04-19, 08:27

Axatax Offline

Rank Newbie

Rank: Newbie
Posts: 34
Joined: 2020-01-17, 14:15

Thanks for doing this. I use SSH2DOS, and it'll be one less inconvenience to deal with every time I upgrade my Linux systems.

Go to top of page Go to top of page

Back to Release Announcements

Main menu

Common searches