Establish SSH connection to OpenVMS Alpha 8.3 + TCP/IP Services 5.6 on DEC AlphaServer | Getting Past diffie-hellman-group1-sha1 and ssh-dss for Legacy Operating Systems

1.558 (RAPTOR) - OpenVMS Alpha: MONITOR SYSTEM

This post falls in the "don't reinvent the wheel" category.

One of my toys is RAPTOR, an emulated AlphaServer ES40 running OpenVMS Alpha 8.3 operating system. It connects to HECnet over DECnet Phase IV, and to the internet using Digital TCP/IP Services for OpenVMS. It runs an internet-facing web-server (OSU DECthreads HTTP Server for OpenVMS), effortlessly handling legitimate and spam traffic serving http://sanyal.duckdns.org.

Digital/Compaq/HP TCP/IP Services for OpenVMS Alpha 5.6 includes a SSH server allowing network access using SSL from SSH clients.

$ TCPIP SHOW VERSION

  HP TCP/IP Services for OpenVMS Alpha Version V5.6
  on an AlphaServer ES40 833 MHz running OpenVMS V8.3

Due to the age of TCP/IP Services for OpenVMS Alpha Version V5.6, modern implementations of SSH clients do not directly establish a secure communications channel with RAPTOR. Ubuntu 17 Linux, for example, provides the following contemporary SSH client:

someuser@moksha:~$ ssh -V
OpenSSH_7.5p1 Ubuntu-10ubuntu0.1, OpenSSL 1.0.2g  1 Mar 2016

and attempting to ssh directly to RAPTOR produces the following error:

someuser@moksha:~$ ssh vmsuser@10.42.2.12

Unable to negotiate with 10.42.2.12 port 22: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1

Looking at the OpenSSH Legacy Options page, I created a ~/.ssh/config file with the following contents:

Host 10.42.2.12

        KexAlgorithms +diffie-hellman-group1-sha1

I set the file permissions for ~/.ssh/config to owner-read/write only (not sure if it is needed), and tried again. But this time, a different error showed up:

someuser@moksha:~$ chmod 600 ~/.ssh/config

someuser@moksha:~$ ls -l ~/.ssh/config

-rw------- 1 someuser somegroup 88 Sep 26 02:17 /home/someuser/.ssh/config

someuser@moksha:~$ ssh vmsuser@10.42.2.12

Unable to negotiate with 10.42.2.12 port 22: no matching host key type found. Their offer: ssh-dss

Looking more at the OpenSSH Legacy Options page, I added another line to ~/.ssh/config file so that the ~/.ssh/config now has a total of three lines in it:

Host 10.42.2.12

        KexAlgorithms +diffie-hellman-group1-sha1

        HostKeyAlgorithms +ssh-dss

And presto, I am able to ssh from Ubuntu 17 into OpenVMS Alpha!

someuser@moksha:~$ ssh vmsuser@10.42.2.12

The authenticity of host '10.42.2.12 (10.42.2.12)' can't be established.

DSA key fingerprint is SHA256:somestring/somestring.

Are you sure you want to continue connecting (yes/no)? yes

Warning: Permanently added '10.42.2.12' (DSA) to the list of known hosts.

vmsuser@10.42.2.12's password:

Welcome to OpenVMS (TM) Alpha Operating System, Version V8.3

System: RAPTOR, AlphaServer ES40 833 MHz

CPU 0    State: RUN                CPUDB: 81C16000     Handle: * None *

       Process: VMSUSER              PID: 000000B9

Product:  DECNET        Node:  RAPTOR               Address(es):  1.558

Product:  TCP/IP        Node:  raptor.sanyalnet.lan Address(es):  10.42.2.12

  26-SEP-2018 02:07:25

$

$

$ lo

Connection to 10.42.2.12 closed.SEP-2018 02:09:35.51

someuser@moksha:~$