{"id":1875,"date":"2015-01-13T19:03:34","date_gmt":"2015-01-13T17:03:34","guid":{"rendered":"http:\/\/hasselba.ch\/blog\/?p=1875"},"modified":"2015-01-13T19:03:34","modified_gmt":"2015-01-13T17:03:34","slug":"hardening-ssh-vs-eclipse-rse","status":"publish","type":"post","link":"https:\/\/hasselba.ch\/blog\/?p=1875","title":{"rendered":"Hardening SSH vs. Eclipse RSE"},"content":{"rendered":"

After hardening the SSH configuration on a Debian server by removing unsecure ciphers and MACs I got in trouble with Eclipse Remote System Explorer.<\/p>\n

When trying to open the server, I always got an „Algorithm negotiation fail“ message:<\/p>\n

\"\"<\/p>\n

Even installing the missing Unlimited Strength version of Java Crypto Extension<\/a> which allows key sizes larger then 128 bit doesn’t helped me out.<\/p>\n

The problem was the allowed KexAlgorithms and the list of MACs in the configuration:<\/p>\n

Ciphers aes256-ctr,aes256-cbc\r\nKexAlgorithms diffie-hellman-group-exchange-sha256\r\nMACs hmac-sha2-512,hmac-sha2-256,hmac-ripemd160<\/code><\/pre>\n
After re-enabling the insecure default configuration by commenting out the both lines in the configuration allowed me to reconnect to the server again.<\/p>\n
Ciphers aes256-ctr,aes256-cbc\r\n#KexAlgorithms diffie-hellman-group-exchange-sha256\r\n#MACs hmac-sha2-512,hmac-sha2-256,hmac-ripemd160<\/code><\/pre>\n
I don’t feel happy about it. But it seems that there is actually no workaround.<\/p>\n","protected":false},"excerpt":{"rendered":"
After hardening the SSH configuration on a Debian server by removing unsecure ciphers and MACs I got in trouble with Eclipse Remote System Explorer. When trying to open the server, I always got an „Algorithm negotiation fail“ message: Even installing … Weiterlesen →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[35],"tags":[],"class_list":["post-1875","post","type-post","status-publish","format-standard","hentry","category-security"],"_links":{"self":[{"href":"https:\/\/hasselba.ch\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1875","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/hasselba.ch\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/hasselba.ch\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/hasselba.ch\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/hasselba.ch\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1875"}],"version-history":[{"count":2,"href":"https:\/\/hasselba.ch\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1875\/revisions"}],"predecessor-version":[{"id":1877,"href":"https:\/\/hasselba.ch\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1875\/revisions\/1877"}],"wp:attachment":[{"href":"https:\/\/hasselba.ch\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1875"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/hasselba.ch\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1875"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/hasselba.ch\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1875"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}