Kitz Forum
Broadband Related => Router Monitoring Software => Topic started by: NewtronStar on August 06, 2017, 03:42:29 PM
-
I was wondering if DSLstats could connect via SHH on the ZyXEL modems to avoid the telnet maxing out any more than 2 the RPI stops collecting stats.
(I've separated these posts from the original topic - Roseway)
-
I was wondering if DSLstats could connect via SHH on the ZyXEL modems to avoid the telnet maxing out any more than 2 the RPI stops collecting stats.
I'll have a look at this. It's certainly possible, but I'm not sure what complications it brings.
-
I was wondering if DSLstats could connect via SHH on the ZyXEL modems to avoid the telnet maxing out any more than 2 the RPI stops collecting stats.
There's a telnet -> SSH proxy script here you could run on your pi, then set dslstats to connect to the local proxy. No guarantee it will work, haven't tried it.
https://github.com/crumbjp/ssh-telnet/blob/master/telnet-proxy
edit: actually it looks like that does the opposite of what you want... oops
-
. . . but I'm not sure what complications it brings.
A ssh connection will be encrypted.
Basically you will need to interact with the "other end" of the link, to negotiate which encryption protocol to use . . . and all that process will entail. :-X
-
Thank you. If I can work out how to login to my modem manually using ssh, then maybe I can reproduce it in DSLstats.
-
Hi
I hope you don't mind, but just arrived back and having a quick read
Does ssh allow more then 1 connection to zylex
If not, there's no benefit sorry
Also, if wanting to use ssh to secure connection over telnet, then this is Internal network only (cannot see ssh been open to Internet on router), so mostly I cannot reason for this sorry
Lastly, it maybe most routers do not use ssh but perhaps could if ssh were to be installed
Sorry if I am wrong and willl look tommorow after a good sleep
Many thanks
John
-
John, I don't think that there is any intention to use ssh for remote connections to the modem. As far as I understand, we're talking about local connections on port 22, which is supported on some modems but not others. If I try on my VMG8324-B10A (with firmware 6b1) this is what I get:
eric@great-tit:~$ ssh admin@192.168.1.1
Unable to negotiate with 192.168.1.1 port 22: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1
eric@great-tit:~$
So the protocol is supported, but I'm not there yet.
-
Hi roseway
Many thanks, and apologies for not been clear sorry. I think sometimes my mind knows what I want to say and fills the gaps in from what I type sorry
I can see the use of ssh if it allows more then 1 connection (using same credentials), so is this possible
In terms of secure connection on local Lan, might be needed but I know ssh is secure, so have to use secure. However, if above is limited to 1 connection, then in my mind, may as well use telnet
I'm sorry, I do not use zylex so cannot test, just did not want you to waste time
I know our platforms are limited to single user ssh (where we allow), and must use sudo to gain root commands.
I hope that explains a little more of what I was trying to say sorry but I could be entirely wrong, so I apologise in advance
Many thanks
John
-
Hi Roseway
I hope you do not mind, but below is a manual connection from command prompt on windows (openssh), which may help perhaps.
I have included a picture and text, so it is clearer.
A thought came to me though, could you not use a third party SSH like putty, and make a call to start in CLI, maybe easier (or bitvise for scripting)
I hope that helps a little but sorry of I am wrong or confusing issues for you sorry
Many thanks
John
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.
C:\Users\*****>ssh nnn.co.uk -l root
root@nnn.co.uk's password:
Last login: Mon Aug 7 09:30:42 2017 from nnn.nnn.nnn.nnn
[root@nnn ~]# logout
Connection to nnn.co.uk closed.
C:\Users\*****>ssh
usage: ssh [-1246AaCfghkNnqsTtVvXxY] [-b bind_address] [-c cipher_spec]
[-D port] [-e escape_char] [-F configfile] [-i identity_file]
[-L port:host:hostport] [-l login_name] [-m mac_spec] [-o option]
[-p port] [-R port:host:hostport] [user@]hostname [command]
C:\Users\*****>
-
Hi Roseway
Sorry, rereading I think I may have made a mistake, as you are using linux, not windows.
I could be entirely wrong sorry, but do you have openssl installed. If not, this could explain the failure sorry.
To try to help a little, please see a SSH from a linux to linux server, but I am sure you have this anyway sorry
Many thanks
John
Actually, you may have OpenSSL installed, but the old cipher maybe disabled in your version of OpenSSL (http://blog.ffelix.eti.br/ssh-no-matching-key-exchange-method-found-their-offer-diffie-hellman-group1-sha1/)
When a SSH client connects to a server, each side offers lists of connection parameters to the other. These are, with the corresponding ssh_config keyword:
•KexAlgorithms: the key exchange methods that are used to generate per-connection keys
•Ciphers: the ciphers to encrypt the connection
•MACs: the message authentication codes used to detect traffic modification
•PubkeyAcceptedKeyTypes: the public key algorithms that the server can use to authenticate itself to the client
•For a successful connection, there must be at least one mutually-supported choice for each parameter.
If the client and server are unable to agree on a mutual set of parameters then the connection will fail. OpenSSH (7.0 and greater) will produce an error message like this:
Unable to negotiate with legacyhost: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1
In this case, the client and server were unable to agree on the key exchange algorithm. The server offered only a single method diffie-hellman-group1-sha1. OpenSSH supports this method, but does not enable it by default because is weak and within theoretical range of the so-called Logjam attack.
The best resolution for these failures is to upgrade the software at the other end. OpenSSH only disables algorithms that we actively recommend against using because they are known to be weak. In some cases, this might not be immediately possible so you may need to temporarily re-enable the weak algorithms to retain access.
For the case of the above error message, OpenSSH can be configured to enable the diffie-hellman-group1-sha1 key exchange algorithm (or any other that is disabled by default) using the KexAlgorithms option - either on the command-line:
ssh -oKexAlgorithms=+diffie-hellman-group1-sha1 user@legacyhost
or in the ~/.ssh/config file:
Host somehost.example.org
KexAlgorithms +diffie-hellman-group1-sha1
The ‘+’ before the list instructs ssh to append the algorithm to the client’s default set rather than replacing the default. By appending, you will automatically upgrade to the best supported algorithm when the server starts supporting it.
Another example, this time where the client and server fail to agree on a public key algorithm for host authentication:
Unable to negotiate with legacyhost: no matching host key type found. Their offer: ssh-dss
OpenSSH 7.0 and greater similarly disable the ssh-dss (DSA) public key algorithm. It too is weak and we recommend against its use. It can be re-enabled using the HostKeyAlgorithms configuration option:
ssh -oHostKeyAlgorithms=+ssh-dss user@legacyhost
or in the ~/.ssh/config file:
Host somehost.example.org
HostKeyAlgorithms +ssh-dss
Depending on the server configuration, it’s possible for other connection parameters to fail to negotiate. You might find the Ciphers and/or MACs configuration options useful for enabling these. It’s also possible to query which algorithms ssh supports:
ssh -Q cipher # List supported ciphers
ssh -Q mac # List supported MACs
ssh -Q key # List supported public key types
ssh -Q kex # List supported key exchange algorithms
Finally, it’s also possible to query the configuration that ssh is actually using when attempting to connect to a specific host, by using the -G option:
ssh -G user@somehost.example.com
which will list all the configuration options, including the chosen values for the Ciphers, MACs, HostKeyAlgorithms and KexAlgorithms parameters.
Last login: Mon Aug 7 09:34:43 2017 from nnn.nnn.nnn.nnn
[root@nnn ~]# ssh external.ssh.server
The authenticity of host 'external.ssh.server (nnn.nnn.nnn.nnn)' can't be established.
RSA key fingerprint is 57:vv:vv:vv:vv:vv:vv:vv:vv:vv:vv:vv:vv:vv:vv:vv.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added 'external.ssh.server,nnn.nnn.nnn.nnn' (RSA) to the list of known hosts.
reverse mapping checking getaddrinfo for . [nnn.nnn.nnn.nnn] failed - POSSIBLE BREAK-IN ATTEMPT!
root@external.ssh.server's password:
Last login: Thu Jul 27 09:19:27 2017 from hostnnn-nnn-nnn-nnn.in-addr.btopenworld.com
[root@444 ~]# logout
Connection to external.ssh.server closed.
-
John, thank you very much for that detailed information. I'm going to stick an ice pack on my head and ponder it.
-
Hi roseway
Sorry, i believe I am wrong as I was dealing with the wrong end of connection
Thinking more, it is likely at your end where the cipher is not enabled
You may want to regen your keygen to include the old cipher, so when the connection is attempted, you have the cipher that the router uses
Before you do regen, you may want to check what ciphers are available though
I hope that makes sense and apologise for been wrong
Many thanks
John
-
I was getting the same error when attempting to ssh into my router. I had to uncomment the Ciphers and MACs lines in the host stanza and add the key algorithms as above in /etc/ssh/ssh_conf on my computer.
Ciphers aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc
MACs hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-ripemd160
HostkeyAlgorithms +ssh-dss,ssh-rsa
KexAlgorithms +diffie-hellman-group1-sha1
ssh admin@192.168.2.1
The authenticity of host '192.168.2.1 (192.168.2.1)' can't be established.
RSA key fingerprint is SHA256:S8f+wKXkTiZy8MVgwlNgV3l1N1U/uxjh48olQ/ta+QE.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '192.168.2.1' (RSA) to the list of known hosts.
admin@192.168.2.1's password:
>
-
No apologies needed John, you've given me enough understanding to see what I'm working with, and I can now login manually to my modem by ssh. I have to specify the key exchange algorithm and the cipher. Remembering that the end objective is to incorporate this into DSLstats, I'm already thinking that it may be too complicated, because each individual system would need to be configured with some specific parameters.
(I see that vic0239 has been through this too, and has used a system configuration solution, whereas I added the required parameters to the ssh command line.)
-
Hi roseway
Many thanks, glad you've resolved your login
If it helps, the key fingerprint once added, is permanent, so all you need to do is script so when asked, it answers yes
I myself would not attempt to install openssh, or whichever ssh is installed. Just write the code for if ssh is installed, so it can use it, and on help page of your website, have the changes needed for cipher
I hope that helps but kudos to you
Many thanks
John
-
Thanks again John. No, I won't be trying to install any ssh library, there are far too many target systems to take into account.
-
I've sorted out manual logging in, and I could reproduce this in DSLstats. Unfortunately, having done this a few times I'm now locked out of SSH access to the modem, so it looks as though the Zyxel firmware has a built in limit for the number of repeated SSH connections. This will make SSH unusable in DSLstats unless I can find a way of disabling the limit.
-
Found this to be also true at my end you can't even have two ssh sessions open at once from different devices as it knocks out a session until the other is closed, thanks for looking into this I am guessing the ZyXEL only allows one TELNET session and one SHH session open at the same time.
-
I wasn't actually talking about simultaneous connections. I was talking about logging in, disconnecting, logging in again, as DSLstats does. With my modem, I can only do this a few times before it locks me out.
-
Hi
I hope you don't mind but why do you need to make repeated connections.
I'm sorry I do not understand why but I may have thought just make 1 connection, then send a keepalive command such as ? (Display help) sat every 2 minutes so the connection is live or add the logout command
I hope you don't mind my thoughts
Many thanks
John
-
DSLstats logs in only for the time it takes to collect the data, then it disconnects until the next sample is due. Staying logged in would involve quite a lot of redesign, and would also lock out HG612_Modem_Stats with those modems which only allow a single telnet login. I'm thinking about it again now.
-
Hi roseway
Many thanks, much appreciated
Sorry I did not understand sorry but kudos to you
Many thanks
John
-
I've regained SSH access after about 2 hours, so it may be practical to enable a permanent SSH connection which won't conflict with HG612_Modem_Stats. Please understand that I'm outside my comfort zone here, so it will take some time.
-
Hi d2d4j i'll give you and example have DSLstats collecting stats via telenet on RPI and it sends to MDWS now let say I want to also run DSLstats from the PC via telnet no upload to MDWS the RPI telnet session will stop with ZyXEL but the Billion 8800NL R1 never had any issue with multiple sessions open at once had up 8 working fine.
My thinking to overcome the ZyXEL drawback was to have telnet or ssh as a selectable option one using telnet the other using ssh
-
Hi
@roseway many thanks. I was thinking in terms of how php usually works with MySQL - connect once (but telnet and ssh do not allow persistent I do not think, so was thinking how ftp works, by throwing a null command to keep alive).
I thought it maybe a simple case of stopping the call to reconnect and just create a new secondary call to the commands used once connected. Sorry I do realise I do not know your program and is very easy to suggest, whilst not appreciating the effort needed sorry.
&newtonstar many thanks. I understand a little more sorry. Good thinking
The good news though, is it is expanding everyone's understanding of SSL/SSH
I hope you both have a lovely night
Many thanks
John
-
I've made some progress with this, but I may also have hit a brick wall. I configured DSLstats to use SSH as an option, and in SSH mode it logs in once and stays logged in until the user hits the stop button or closes DSLstats down. This worked quite well on my Linux system, and it collected data once a minute for about 40 minutes. At the same time another instance of DSLstats on a different machine was connecting by telnet and uploading to MDWS.
However, after about 40 minutes the modem abruptly rebooted and the telnet session resumed but the SSH session didn't. I got the impression that the SSH session was stressing the modem too much. Data collection by SSH was very slow - after the initial 6 seconds to log in, each sample took about 12 seconds to collect the full set of data.
I'm not sure where I'm going to go from here.
-
Hi roseway
Kudos to you
Just an idea, instead of streaming the data to you Linux, why not save the data to a file on the router, then use rsync to transfer the file to your Linux
I'm sorry if this is the method you use as I am not sure how you are receiving the data, so could be entirely wrong sorry
Many thanks
John
-
I don't think that will work unless rsync is installed on the router. I think it would be even more work for the router to transfer data separately over some protocol like tftp.
-
@d2d4j: What DSLstats does is exactly the same as one would do by logging in manually. That is, it sends a command and reads the response, then sends another command, and so on. To implement your suggestion I would still have to send each command in turn, but redirect the responses to a file. I think that would be at least as much work for the modem as reading the responses directly, even before collecting the contents of the file.
-
Hi ejs and roseway
Many thanks, and sorry it was just a suggestion sorry, based on it might have been quicker writing to a file on router then transfer file
Many thanks and have a lovely weekend
John
-
There's nothing for you to apologise for, John. All suggestions are welcome, and without your help I wouldn't have got started. :)
-
Hi roseway
Many thanks
The additional stress then is the ssl encryption (it even happens on very low powered servers), so I'm thinking the router rebooted due to excessive heat or it simple ran out of resources perhaps. Sorry if I am wrong
As I do not have or use zylex, does the zylex have ftp or can a folder be set to shared over network
My thinking is to change the collection of stats to collection of files by ftp or shared (but no encryption) and upload the commands as executable files, in a cron job on router
I'm sorry though, this may not be possible for many reasons, i.e. No ftp or shared folder over network or it may not be possible to add the files containing the commands and/or add to cron
I'll have a think though, but if router is rebooting regularly, then it is not usable
The other thought I had was to make dslstats collected data shareable with another dslstats from the computer dslstats is running on, in order for the second copy of dslstats to collect and process, so it has no need to contact router (essentially as per idea I mention earlier with router). You could then even go further and make the dslstats collecting by telnet to router the primary master, the dslstats then collecting from the primary master the slave, with a ping (or similar to primary master), to see if primary master is alive, if no response, the slave takes over collecting from the router and stops the collection of files from the primary master
I hope that makes a little sense, and apologise if I'm wrong sorry
Many thanks
John
-
Hi
Sorry, I could be entirely wrong as do not use zylex but a better thought came to me
Does the zylex have/use multi Lan (192.168.1.1, 192.168.2.1 etc)
If it does, perhaps it allows telnet on each as a separate connection
Just a thought
Many thanks
John
-
I do appreciate these suggestions, but I fear that they're becoming too complicated. The objective is to develop a version of DSLstats using a different protocol from telnet, which I can offer to users to install on Linux, Windows and Raspberry Pi systems without a lot of system intervention required of the users. It should also work on a variety of modems. The SSH option would have met these requirements, the only system intervention being to install libssh2 on Linux/RPi systems. I could package a suitable SSH support DLL with the Windows version.
-
Hi roseway
Many thanks and sorry, I thought of that afterwards
My other thought of multiple telnet sessions using subnet does not work on Draytek so guess that's out
I'm sure you realise, but if you release ssh as an option, I could appreciate you may become pestered if the router keeps rebooting, from users who perhaps do not fully understand and expect things to just work
Sorry if I am wrong and kudos to you for finishing work on ssh.
Many thanks
John
-
Yes, your warning is understood. I won't be releasing it generally in its present state.
-
After more thought I'm putting this on ice now (apologies to NS who asked for it). I got it working, but it was putting too much stress on the modem, presumably because of the need for encryption. I don't want to release a program which might work with some modems, but might possibly damage others. Thank you for the help I've received in getting this far.
-
SSh connection would also be usefull for openwrt modem that doesn't have any telnet connection at all (only SSH for secure reason)
If you want i can test, as i really need dslstats to monitor my vdsl connection...
-
I don't know whether I can help here. I don't have the resources to give ongoing support to something I can't personally test. I could possibly produce a one-off example, depending on what OS you want it for, but I really wouldn't be able to support it after that.
-
Os = windows...
Think my modem is enough powerfull to support multiple ssh connection. Can i test it pls?
(the idea about making SSH an option was good anyway)
-
OK, I'll see if I can build a Windows version. I do my development on a Linux machine, so that's what I used in my first experiment. It will take two or three days.
-
Hi roseway
I hope you do not mind, and I have thought about your offer to supply a test for ssh and the more I think about it, I do believe you should make a statement to exclude yourself and software from any blame, should anything untoward happen.
I'm thinking any issues would most likely be a dlm intervention (even banding) etc...
It's just my thoughts and I mean no offence to any user. It just covers you.
Many thanks
John
-
Thank you for that excellent advice, John. As it happens, I do have a disclaimer at the bottom of my downloads page, but in this particular case I would make it more prominent if it does get released (which currently seems rather unlikely).
-
Can't wait to test it...
-
I'm sorry Ansuel, but it isn't going to happen. I've already spent more time than I can spare on this without success, and I can't spend any more. Sorry.
-
Oh this is a shame, it was such a useful program but now it can't be used by so many with telnet removed from firmware releases as insecure.
-
Oh this is a shame, it was such a useful program but now it can't be used by so many with telnet removed from firmware releases as insecure.
Windows 10 still has telnet, you just need to enable it, and I'm sure most Linux distributions will run it but again it might need to be installed.
:)
-
Windows 10 still has telnet, you just need to enable it, and I'm sure most Linux distributions will run it but again it might need to be installed.
:)
With them saying firmware I assume they meant newer routers wont have telnet enabled due to security issues. Then again, most wont have SSH either.
-
With them saying firmware I assume they meant newer routers wont have telnet enabled due to security issues. Then again, most wont have SSH either.
Yes you're right, but as you say SSH ability won't help much here.
:)
-
Plus I'd be concerned that the overhead of SSH might spike CPU usage on a router.
-
^^^
That was certainly what I found when I was experimenting with SSH in DSLstats.