ssh_dispatch_run_fatal: código de autenticação de mensagem incorreto

Question

Desde alguns dias, estou enfrentando um problema enquanto estou conectado ao meu servidor em ssh, para uso de proxy / tunel.

I - Configuração

Cliente

Aqui está a máquina:

iMac:~ Luca$ sw_vers

ProductName: Mac OS X

ProductVersion: 10.11.6

BuildVersion: 15G1108

iMac:~ Luca$ sudo sysctl net.inet.ip.forwarding

net.inet.ip.forwarding: 0

iMac:~ Luca$ sudo sysctl net.inet.ip.fw.enable

net.inet.ip.fw.enable: 1

Tentei em três redes diferentes.

Navegador

Estou usando o Firefox 50.0.1 para navegar na Internet, com a extensão FoxyProxy configurada da seguinte forma:

host address : 127.0.0.1

port : 9999

socks v5

comando SSH

Estou usando o Terminal.app para me conectar no ssh ao meu servidor.

iMac:~ Luca$ ssh -p 53 -D 9999 luca@myIP

Servidor

luca@myServer:~$ ssh -V

OpenSSH_6.7p1 Debian-5+deb8u3, OpenSSL 1.0.1t 3 May 2016

luca@myServer:~$ cat /proc/sys/net/ipv4/ip_forward

1

II - esperado

Quando a conexão estiver aberta, posso navegar em qualquer site sem qualquer problema (com meu IP sendo meu servidor).

Isso foi bom até alguns dias. Isso ainda está bem se eu tentar:

• mesmo servidor (A), outro computador (Y)
• mesmo computador (X), outro servidor (B)

Do que parece, ele não funciona com meu computador (X) e meu servidor (A).

III - O que acontece

luca@myServer:~$ ssh_dispatch_run_fatal: Connection to myIP: message authentication code incorrect

A conexão é então fechada.

Esta mensagem aparece em tempo aleatório. Mas posso reproduzi-lo facilmente com uma grande carga de dados através do proxy: carregue vários vídeos, baixe arquivos grandes, etc ...

IV - Outra forma, problema similar

Se eu me conectar ao meu servidor através do sftp: // (com o FileZilla) com o mesmo login (luca) e a mesma porta (53). Então tento baixar um arquivo, a cada 30 segundos recebo o seguinte erro:

Error : Incorrect MAC received on packet

Mais uma vez, isso acontece apenas com meu computador (X) e meu servidor (A). Se eu tentar outro servidor (B) no mesmo computador (X): não há problema. Se eu tentar o mesmo servidor (A) em outro computador (Y): não há problema.

V - O que eu tentei (e não consertei)

1. Reinicialize o servidor e o computador
2. Reinicie o ssh / sshd no servidor e no computador
3. Exclua o arquivo knowns_hosts no computador
4. Especifique um -m e -c com o comando ssh
5. Especifique um -o GSSAPIKeyExchange=no no comando ssh
6. Descomente as linhas de Cifras e / ou MACs em /etc/ssh/ssh_config no servidor ou / e no computador
7. Tentei ver a opção -vvvvv com o comando ssh e ler os logs no servidor / computador, nada parecia relacionado.

Qualquer ajuda seria apreciada.

APÊNDICE

Servidor ssh -Q mac

luca@myServer:~$ ssh -Q mac hmac-sha1 hmac-sha1-96 hmac-sha2-256 hmac-sha2-512 hmac-md5 hmac-md5-96 hmac-ripemd160 [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected]

Computador ssh -Q mac

iMac:~ Luca$ ssh -Q mac hmac-sha1 hmac-sha1-96 hmac-sha2-256 hmac-sha2-512 hmac-md5 hmac-md5-96 hmac-ripemd160 [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected]

Servidor ssh -v -p 53 -D 9999 luca@myIP

iMac:~ Luca$ ssh -v -p 53 -D 9999 luca@myIP

OpenSSH_6.9p1, LibreSSL 2.1.8
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 21: Applying options for *
debug1: Connecting to myIP [myIP] port 53.
debug1: Connection established.
debug1: key_load_public: No such file or directory
debug1: identity file /Users/Luca/.ssh/id_rsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /Users/Luca/.ssh/id_rsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /Users/Luca/.ssh/id_dsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /Users/Luca/.ssh/id_dsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /Users/Luca/.ssh/id_ecdsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /Users/Luca/.ssh/id_ecdsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /Users/Luca/.ssh/id_ed25519 type -1
debug1: key_load_public: No such file or directory
debug1: identity file /Users/Luca/.ssh/id_ed25519-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.9
debug1: Remote protocol version 2.0, remote software version OpenSSH_6.7p1 Debian-5+deb8u3
debug1: match: OpenSSH_6.7p1 Debian-5+deb8u3 pat OpenSSH* compat 0x04000000
debug1: Authenticating to myIP:53 as 'luca'
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client [email protected] <implicit> none
debug1: kex: client->server [email protected] <implicit> none
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ecdsa-sha2-nistp256 SHA256:DUAAYL1r0QUDtRI89JozTTz+bm5wcg4cOSaFaRdbr/Y
debug1: Host '[myIP]:53' is known and matches the ECDSA host key.
debug1: Found key in /Users/Luca/.ssh/known_hosts:1
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,password
debug1: Next authentication method: publickey
debug1: Trying private key: /Users/Luca/.ssh/id_rsa
debug1: Trying private key: /Users/Luca/.ssh/id_dsa
debug1: Trying private key: /Users/Luca/.ssh/id_ecdsa
debug1: Trying private key: /Users/Luca/.ssh/id_ed25519
debug1: Next authentication method: password

luca@myIP's password:

debug1: Authentication succeeded (password).
Authenticated to myIP ([myIP]:53).
debug1: Local connections to LOCALHOST:9999 forwarded to remote address socks:0
debug1: Local forwarding listening on ::1 port 9999.
debug1: channel 0: new [port listener]
debug1: Local forwarding listening on 127.0.0.1 port 9999.
debug1: channel 1: new [port listener]
debug1: channel 2: new [client-session]
debug1: Requesting [email protected]
debug1: Entering interactive session.
debug1: Sending environment.
debug1: Sending env LANG = fr_FR.UTF-8
Debian GNU/Linux 8.6

Linux <server> #1 SMP Tue Mar 18 14:48:24 CET 2014 x86_64 GNU/Linux

server    : 274305
hostname  : myServer
eth0 IPv4 : myIPv4
eth0 IPv6 : myIPv6
Last login: Thu Dec  8 15:36:09 2016 from XXX.XXX.XXX.XXX

luca@myServer:~$

Erro que vejo em algum momento

luca@myServer:~$ Bad packet length 3045540078.

padding error: need -1249427218 block 8 mod 6

ssh_dispatch_run_fatal: Connection to 5.39.88.21: message authentication code incorrect

Servidor ssh -o macs=hmac-sha1 -v -p 53 -D 9999 luca@myServer quando o problema acontece

iMac:~ Luca$ ssh -o macs=hmac-sha1 -v -p 53 -D 9999 luca@myIP
// [...]
luca@myServer:~$ debug1: Connection to port 9999 forwarding to socks port 0 requested.
debug1: channel 3: new [dynamic-tcpip]
debug1: Connection to port 9999 forwarding to socks port 0 requested.
debug1: channel 4: new [dynamic-tcpip]
debug1: Connection to port 9999 forwarding to socks port 0 requested.
debug1: channel 5: new [dynamic-tcpip]
debug1: Connection to port 9999 forwarding to socks port 0 requested.
debug1: channel 6: new [dynamic-tcpip]
debug1: Connection to port 9999 forwarding to socks port 0 requested.
debug1: channel 7: new [dynamic-tcpip]
debug1: Connection to port 9999 forwarding to socks port 0 requested.
debug1: channel 8: new [dynamic-tcpip]
debug1: Connection to port 9999 forwarding to socks port 0 requested.
debug1: channel 9: new [dynamic-tcpip]
debug1: Connection to port 9999 forwarding to socks port 0 requested.
debug1: channel 10: new [dynamic-tcpip]
debug1: Connection to port 9999 forwarding to socks port 0 requested.
debug1: channel 11: new [dynamic-tcpip]
debug1: Connection to port 9999 forwarding to socks port 0 requested.
debug1: channel 12: new [dynamic-tcpip]
debug1: Connection to port 9999 forwarding to socks port 0 requested.
debug1: channel 13: new [dynamic-tcpip]
debug1: Connection to port 9999 forwarding to socks port 0 requested.
debug1: channel 14: new [dynamic-tcpip]
debug1: Connection to port 9999 forwarding to socks port 0 requested.
debug1: channel 15: new [dynamic-tcpip]
debug1: Connection to port 9999 forwarding to socks port 0 requested.
debug1: channel 16: new [dynamic-tcpip]
debug1: Connection to port 9999 forwarding to socks port 0 requested.
debug1: channel 17: new [dynamic-tcpip]
debug1: Connection to port 9999 forwarding to socks port 0 requested.
debug1: channel 18: new [dynamic-tcpip]
debug1: Connection to port 9999 forwarding to socks port 0 requested.
debug1: channel 19: new [dynamic-tcpip]
ssh_dispatch_run_fatal: Connection to myIP : message authentication code incorrect
iMac:~ Luca$

Depois de atualizar o SSH no lado do cliente

iMac:~ Luca$ ssh -V
OpenSSH_7.3p1, OpenSSL 1.0.2j  26 Sep 2016

iMac:~ Luca$ ssh -p 53 -D 9999 luca@myIP
luca@myIP's password: 
luca@ns3274305:~$ ssh_dispatch_run_fatal: Connection to myIP port 53: message authentication code incorrect

iMac:~ Luca$ ssh -o macs=hmac-sha1 -p 53 -D 9999 luca@myIP
luca@myIP's password: 
luca@ns3274305:~$ ssh_dispatch_run_fatal: Connection to myIP port 53: message authentication code incorrect
iMac:~ Luca$

    

Answer 1

Eu atualizei do Mac OS El Capitan (10.11) para o Mac OS Sierra (10.12).

O problema não ocorre mais.

Eu ainda não sei qual era o problema.