• SSH

    From Mortifis@1:103/705 to All on Tue Jan 29 08:19:47 2019
    I recently configured for SSH and have been seeing a lot of Terminal Log entries similar to this:

    1/29 08:14:23a 1372 SSH connection accepted from: <edited ip> port 41408
    1/29 08:14:25a 1372 SSH WARNING 'Client sent malformed identifier string 'SSH-2.0-Go'' (-32) setting session active from bbs_thread
    1/29 08:14:25a 1372 SSH session establishment failed
    1/29 08:15:18a 1496 SSH connection accepted from: <edited ip> port 51420
    1/29 08:15:20a 1496 SSH active channel 'direct-tcpip' is not 'session', disconnecting.
    1/29 08:15:20a 1496 SSH session establishment failed

    is that a client issue, or perhaps a mis-configuration issue?

    ---
    * Synchronet * AlleyCat! BBS - http://alleycat.synchro.net:81
    * Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)
  • From mark lewis@1:3634/12.73 to Mortifis on Tue Jan 29 08:05:36 2019

    On 2019 Jan 29 08:19:46, you wrote to All:

    1/29 08:15:18a 1496 SSH connection accepted from: <edited ip> port 51420 1/29 08:15:20a 1496 SSH active channel 'direct-tcpip' is not 'session', disconnecting.
    1/29 08:15:20a 1496 SSH session establishment failed

    is that a client issue, or perhaps a mis-configuration issue?

    is this a legit random connection or something you are specifically testing? i see similar ones here and they've all been skiddies trying to get in...

    )\/(ark

    Always Mount a Scratch Monkey
    Do you manage your own servers? If you are not running an IDS/IPS yer doin' it wrong...
    ... Even Murphy's Law doesn't work all the time.
    ---
    * Origin: (1:3634/12.73)
  • From Mortifis@1:103/705 to mark lewis on Tue Jan 29 10:05:51 2019
    On 2019 Jan 29 08:19:46, you wrote to All:

    1/29 08:15:18a 1496 SSH connection accepted from: <edited ip> port 51420 1/29 08:15:20a 1496 SSH active channel 'direct-tcpip' is not 'session', disconnecting.
    1/29 08:15:20a 1496 SSH session establishment failed

    is that a client issue, or perhaps a mis-configuration issue?

    is this a legit random connection or something you are specifically testing? i see similar ones here and they've all been skiddies trying to get in...

    Not sure if they are legit or bots, I'll assume they are bots, but if someone could try to SSH alleycat.synchro.net and let me know if the connection is successful or not, I'd appreciate it.

    ---
    * Synchronet * AlleyCat! BBS - http://alleycat.synchro.net:81
    * Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)
  • From poindexter FORTRAN@1:103/705 to mark lewis on Tue Jan 29 06:37:40 2019
    Re: SSH
    By: mark lewis to Mortifis on Tue Jan 29 2019 08:05 am

    is this a legit random connection or something you are specifically testing? i see similar ones here and they've all been skiddies trying to get in...

    "Skiddies". Love it.

    ---
    * Synchronet * realitycheckBBS -- http://realitycheckBBS.org
    * Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)
  • From echicken@1:103/705 to Mortifis on Tue Jan 29 11:35:48 2019
    Re: SSH
    By: Mortifis to All on Tue Jan 29 2019 08:19:47

    'SSH-2.0-Go'' (-32) setting session active from bbs_thread

    That comes from an SSH library for Go. Could be someone trying their SSH client, more likely they're trying to automate some hack.

    is that a client issue, or perhaps a mis-configuration issue?

    Very likely a client issue, especially if your server is working with other known-good SSH clients.

    ---
    echicken
    electronic chicken bbs - bbs.electronicchicken.com - 416-425-5435
    * Synchronet * electronic chicken bbs - bbs.electronicchicken.com
    * Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)
  • From Mortifis@1:103/705 to echicken on Tue Jan 29 14:07:27 2019
    Re: SSH
    By: Mortifis to All on Tue Jan 29 2019 08:19:47

    'SSH-2.0-Go'' (-32) setting session active from bbs_thread

    That comes from an SSH library for Go. Could be someone trying their SSH client, more likely they're trying to automate some hack.

    is that a client issue, or perhaps a mis-configuration issue?

    Very likely a client issue, especially if your server is working with other known-good SSH clients.

    I'm not entirely sure, it works when I use Syncterm locally. I'll just assume it's a hack attempt and be happy knowing you Devs are very security minded when you code SBBS services, etc :-)

    Thanks

    ---
    * Synchronet * AlleyCat! BBS - http://alleycat.synchro.net:81
    * Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)
  • From Retro Guy@1:103/705 to Mortifis on Tue Jan 29 13:47:59 2019
    Re: SSH
    By: Mortifis to All on Tue Jan 29 2019 08:19 am

    I recently configured for SSH and have been seeing a lot of Terminal Log entries similar to this:

    1/29 08:14:23a 1372 SSH connection accepted from: <edited ip> port 41408 1/29 08:14:25a 1372 SSH WARNING 'Client sent malformed identifier string 'SSH-2.0-Go'' (-32) setting session active from bbs_thread
    1/29 08:14:25a 1372 SSH session establishment failed
    1/29 08:15:18a 1496 SSH connection accepted from: <edited ip> port 51420 1/29 08:15:20a 1496 SSH active channel 'direct-tcpip' is not 'session', disconnecting.
    1/29 08:15:20a 1496 SSH session establishment failed

    is that a client issue, or perhaps a mis-configuration issue?

    This just looks like connections trying your ssh port looking for holes (portscan of sorts). They're being disconnected so it looks like everything is working properly. I'd expect to see connection attempts at most every common port all day long that go nowhere.

    I'm assuming you are able to SSH in.

    Retro Guy

    ---
    * Synchronet * RetroBBS - bbs.rocksolidbbs.com
    * Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)
  • From Mortifis@1:103/705 to Retro Guy on Tue Jan 29 16:14:07 2019
    Re: SSH
    By: Mortifis to All on Tue Jan 29 2019 08:19 am

    I recently configured for SSH and have been seeing a lot of Terminal Log entries similar to this:

    1/29 08:14:23a 1372 SSH connection accepted from: <edited ip> port 41408 1/29 08:14:25a 1372 SSH WARNING 'Client sent malformed identifier string 'SSH-2.0-Go'' (-32) setting session active from bbs_thread
    1/29 08:14:25a 1372 SSH session establishment failed
    1/29 08:15:18a 1496 SSH connection accepted from: <edited ip> port 51420 1/29 08:15:20a 1496 SSH active channel 'direct-tcpip' is not 'session', disconnecting.
    1/29 08:15:20a 1496 SSH session establishment failed

    is that a client issue, or perhaps a mis-configuration issue?

    This just looks like connections trying your ssh port looking for holes (portscan of sorts). They're being disconnected so it looks like everything is working properly. I'd expect to see connection attempts at most every common port all day long that go nowhere.


    Yep, been watching port scanners, hack attempts and bots on all open ports for decades :-/

    I'm assuming you are able to SSH in.

    Yes, but I am doing it within the LAN, so ...

    ---
    * Synchronet * AlleyCat! BBS - http://alleycat.synchro.net:81
    * Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)
  • From Digital Man@1:103/705 to Mortifis on Tue Jan 29 14:45:09 2019
    Re: SSH
    By: Mortifis to All on Tue Jan 29 2019 08:19 am

    I recently configured for SSH and have been seeing a lot of Terminal Log entries similar to this:

    1/29 08:14:23a 1372 SSH connection accepted from: <edited ip> port 41408 1/29 08:14:25a 1372 SSH WARNING 'Client sent malformed identifier string 'SSH-2.0-Go'' (-32) setting session active from bbs_thread
    1/29 08:14:25a 1372 SSH session establishment failed
    1/29 08:15:18a 1496 SSH connection accepted from: <edited ip> port 51420 1/29 08:15:20a 1496 SSH active channel 'direct-tcpip' is not 'session', disconnecting.
    1/29 08:15:20a 1496 SSH session establishment failed

    is that a client issue, or perhaps a mis-configuration issue?

    It's an attack script written in "Go" (the programming language by Google).

    digital man

    Synchronet "Real Fact" #61:
    How to get Synchronet technical support: http://wiki.synchro.net/howto:support Norco, CA WX: 70.0oF, 44.0% humidity, 4 mph E wind, 0.00 inches rain/24hrs
    --- SBBSecho 3.06-Linux
    * Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)
  • From Retro Guy@1:103/705 to All on Wed Jan 30 03:24:15 2019
    On Tue, 29 Jan 2019 10:05:51 -0400
    "Mortifis" <mortifis@VERT/ALLEYCAT> wrote:

    On 2019 Jan 29 08:19:46, you wrote to All:

    1/29 08:15:18a 1496 SSH connection accepted from: <edited
    port 51420 1/29 08:15:20a 1496 SSH active channel 'direct-tcpip' is not
    'session', disconnecting.
    1/29 08:15:20a 1496 SSH session establishment failed

    is that a client issue, or perhaps a mis-configuration issue?

    is this a legit random connection or something you are
    specifically testing? i see similar ones here and they've all
    been skiddies trying to get in...

    Not sure if they are legit or bots, I'll assume they are bots, but if
    someone could try to SSH alleycat.synchro.net and let me know if the connection is successful or not, I'd appreciate it.

    It just worked fine for me. Made it to your synchronet login.

    ---
    * Synchronet * RetroBBS - bbs.rocksolidbbs.com
    * Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)
  • From Mortifis@1:103/705 to Retro Guy on Wed Jan 30 11:34:10 2019
    On Tue, 29 Jan 2019 10:05:51 -0400
    "Mortifis" <mortifis@VERT/ALLEYCAT> wrote:

    On 2019 Jan 29 08:19:46, you wrote to All:

    Not sure if they are legit or bots, I'll assume they are bots, but if someone could try to SSH alleycat.synchro.net and let me know if the connection is successful or not, I'd appreciate it.

    It just worked fine for me. Made it to your synchronet login.

    Thank you for checking. It turns out to be a hack script written in Google-Go. All of the various port scanner and hack bots are slowing my system down for legit connections. I ended up disabling ActiveUser (which is legit) because I was getting queries from dozens of system every second!

    ---
    * Synchronet * AlleyCat! BBS - http://alleycat.synchro.net:81
    * Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)
  • From Greg Meckel@1:103/705 to All on Sat Mar 15 18:39:29 2025
    Can anyone tell me how to fix the SSH error: SSH note "Internal consistency check failed"

    Thanks
    Greg
    ---
    * Synchronet * Ice Castle BBS, Anchorage, AK - ice-castle-bbs.net
    * Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)
  • From Digital Man@1:103/705 to Greg Meckel on Sun Mar 16 02:28:26 2025
    Re: SSH
    By: Greg Meckel to All on Sat Mar 15 2025 06:39 pm

    Can anyone tell me how to fix the SSH error: SSH note "Internal consistency check failed"

    From what I've seen, that's just a client issue and not something for the sysop to "fix".
    --
    digital man (rob)

    Synchronet/BBS Terminology Definition #28:
    DTR = Data Terminal Ready
    Norco, CA WX: 47.6oF, 76.0% humidity, 0 mph SE wind, 0.00 inches rain/24hrs
    --- SBBSecho 3.23-Linux
    * Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)
  • From Greg Meckel@1:103/705 to Digital Man on Sun Mar 16 10:29:45 2025
    Re: SSH
    By: Digital Man to Greg Meckel on Sun Mar 16 2025 02:28 am

    Re: SSH
    By: Greg Meckel to All on Sat Mar 15 2025 06:39 pm

    Can anyone tell me how to fix the SSH error: SSH note "Internal consistency check failed"

    From what I've seen, that's just a client issue and not something for the sysop to "fix".

    OK. Thanks DM. I just noticed this error while scrolling through my terminal server screen and searched on the web and found things that were not helpful so thought I'd ask.

    Greg
    ---
    * Synchronet * Ice Castle BBS, Anchorage, AK - ice-castle-bbs.net
    * Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)
  • From Digital Man@1:103/705 to Greg Meckel on Sun Mar 16 15:07:38 2025
    Re: SSH
    By: Greg Meckel to Digital Man on Sun Mar 16 2025 10:29 am

    From what I've seen, that's just a client issue and not something for the sysop to "fix".

    OK. Thanks DM. I just noticed this error while scrolling through my terminal server screen and searched on the web and found things that were not helpful so thought I'd ask.

    The error comes from cryptlib (a third party library) and I agree: the message could be better/clearer, but that's what it is and while it sounds like there's something wrong on the server-side, it does appear to be the case in reality.
    --
    digital man (rob)

    Steven Wright quote #28:
    The hardness of the butter is proportional to the softness of the bread.
    Norco, CA WX: 68.7oF, 44.0% humidity, 7 mph WNW wind, 0.00 inches rain/24hrs --- SBBSecho 3.23-Linux
    * Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)