SSH query

[Ahmed_58]

Dears,
1. can anyone tell the deference between SSH and SSH2?
2. how can I check if SSH2 is installed on HP UNIX? and which port is using?
3. What is this error mean: Can not connect to host localhost on port 22
SSH2 protocol support is not installed! [Unknown cause].

thank you,
Ahmed

[OFC_EDM]

ssh -V (capital V) will tell you the version of ssh I believe. At least on Tru64 it does. I don't have an HP-UX system to verify.

As for port 22 is there a firewall between the systems? Check with the admin to see if port 22 is open to ssh traffic.

To see if the port is working telnet to the port from the host itself. To either local host or the IP of the host. It should bring up something similar to below. Note press Ctrl-] to exit.

telnet localhost 22
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
SSH-1.99-OpenSSH_4.5

[OFC_EDM]

Also if you can post the command you used we can check if there's issues with that.

Cheers

[Johnson Punniyalingam]

Hi Ahmed,

Q:- deference between SSH and SSH2.?
Ans :- Version else some extra hardering aplicable to SSH2

Q:- how can I check if SSH2 is installed on HP UNIX? and which port is using?

Ans :- swlist |grep -i SSH --> this command will currently what ssh version has been Installed.

or

# ssh -version
OpenSSH_4.3p2-hpn, OpenSSL 0.9.7i 14 Oct 2005
HP-UX Secure Shell-A.04.30.007, HP-UX Secure Shell version

this command will currently what ssh version has been Installed.

Q:- What is this error mean: Can not connect to host localhost on port 22
SSH2 protocol support is not installed! [Unknown cause].

Ans :- SSH may not be Installed,

# netstat -an |grep 22 --> this command could check whether port 22 is Listening on the server
tcp 0 0 *.22 *.* LISTEN


Hope this helps

Thanks,
Best Regards,
Johnson

[OFC_EDM]

Forgot to mention. The output of the Ssh -V won't tell you neccessarily if it supports version 2.

But once you have the version you can look that version up on the net to see what it supports.

As well do a man ssh and it typically will tell you in the man page if it supports version 2.

[Matti_Kurkela]

1.) SSH is the generic name: it may mean any version of the SSH protocol.

The original SSH protocol version (now called SSH-1) was used widely in the 1990s, but it turned out the protocol had some weaknesses which could not be fixed without a redesign. Since then, further research has indicated those weaknesses are more severe than was originally thought. It is generally recommended to switch to the newer version if at all possible.

The revised version of the SSH protocol, SSH-2, was designed in 1996. Originally it was available only as a commercial software or with a very restrictive license, so for a while people generally preferred the older version. Then the OpenSSH project was started in 1999 or so, and people switched to it.

OpenSSH can use both protocol versions (SSH-1 and SSH-2) and will auto-detect the correct version. The current recommended practice is to disable the support of the older SSH-1 protocol version unless there is a specific need to use SSH-1.

See:
http://en.wikipedia.org/wiki/Ssh
http://www.snailbook.com/faq/ssh-1-vs-2.auto.html

2.) Both SSH protocol versions use the same default port: TCP/22. If necessary, the SSH server can use any TCP port: it just mean that the clients will need to know the non-default port number to connect.

The simplest way to check whether any version of SSH is installed is to telnet to the port where SSH server is assumed to be running. For example, to find out whether a SSH server is running in port 22 of my Linux workstation:

$ telnet localhost 22
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
SSH-2.0-OpenSSH_4.6p1 Debian-5ubuntu0.6
Connection closed by foreign host.

The SSH server responds to a connection attempt by sending the protocol version number (SSH-2.0) and the software version identification (OpenSSH_4.6 Debian-5ubuntu0.6) in plaintext. If it does not get the proper reply from the SSH client after that, it will disconnect.

When telnetting to the port, the SSH server will receive a telnet option negotiation packet, so it will immediately detect this is not a valid SSH connection and disconnect.

Some SSH servers will report the protocol version as "SSH-1.99". This means "I'm really a SSH-2 server but I'm willing to fall back to SSH-1 protocol if necessary."

3.) The program that produced the error message is looking for SSH server on the same machine and failing to find it.

It may be because:
- no SSH server is installed
- SSH server is installed but not running
- SSH server is installed and running, but it is not using the default port (22) and nobody told the correct number to this program.
- this machine has some traffic filters (e.g. ipfilter for HP-UX) that disallow connection to port 22, even from localhost.

MK

[Ahmed_58]

Thanks to all who replay,

the commnad for SSH executed from the application program, I'm trying to get it from the vendor.
here is the replay to some of the question asked;

# ssh -version
OpenSSH_4.4p1-hpn12v11, OpenSSL 0.9.7l 28 Sep 2006
HP-UX Secure Shell-A.04.40.005, HP-UX Secure Shell version
Bad escape character 'rsion'.
----------------------------------------------------
The telnet screen hang when used with port 22

# telnet batmed1 22
Trying...
Connected to batmed1.btc.com.bh.
Escape character is '^]'.
SSH-2.0-OpenSSH_4.4p1-hpn12v11
----------------------------------------------------
nothing display when check with swlist

# swlist |grep -i SSH
#
---------------------------------------------------
# netstat -an |grep 22
tcp 0 0 *.22 *.* LISTEN
tcp 0 0 *.22 *.* LISTEN
e0000001aab9e380 stream 0 0 e0000004224c1380 0 0 0 /tmp/.oracle/sEXTPROC
e0000001be2ee680 dgram 0 0 e00000018224a400 0 0 0 /var/spool/sockets/pwgr/client23671
----------------------------------------------------------
Just try again , this time worked. NO changes done! , I wonder how/way?
As we are planning to move to production.
Regards,
Ahmed

[OFC_EDM]

It's normal for the telnet to hang when telnetting to port 22. You simply want to see it come back with the SSH information. Which lets you know it's active on that port.

Then you do the CTRL-] to exit.

[Matti_Kurkela]

The "ssh -version" command indicates the version of your ssh client.

The "telnet localhost 22" output indicates the version of your ssh server.

Normally both come packaged together, but it is possible to use different server/client versions if there is a special need to do so.

Your "swlist | grep -i SSH" did not produce any results, because neither the bundle name nor its description contain the word "SSH". The HP-packaged SSH is known as "HP-UX Secure Shell" and its product number is T1471AA.

So try again, with "swlist | grep -i secure".
I'd guess you'll get output similar to the following:

T1471AA A.04.40.005 HP-UX Secure Shell

Your netstat output indicates that there is a process listening on port 22, so everything seems to be OK.

Has your server been rebooted in between your tries?

Maybe, at the time of your first try, the SSH package was installed but the SSH server was not started. The default installation will set SSH server to auto-start at reboot, but I don't think it will start it automatically at the end of the installation. (I'm not sure about this...)

If the server was rebooted before your second try, the SSH server was started (for the first time?) at system bootup.

MK

[Ahmed_58]

Dears,
Can anyone tell if the reason I'm getting the connection close when trying to use sftp because of the ssh version I'm using;
--------------------------
ServerA:
batmed1:/>ssh -V
OpenSSH_4.4p1-hpn12v11, OpenSSL 0.9.7l 28 Sep 2006
HP-UX Secure Shell-A.04.40.005, HP-UX Secure Shell version
--------------------------
ServerB:
$ ssh -V
OpenSSH_4.7p1+sftpfilecontrol-v1.2-hpn12v17, OpenSSL 0.9.7m 23 Feb 2007
HP-UX Secure Shell-A.04.70.021, HP-UX Secure Shell version
---------------------------
I can connect from serverB to ServerA but not vis versa!!

Ahmed

[Gweeper64]

ServerB has a newer version of SSH. I would try upgrading SSH on ServerA.