diffie-hellman | pure js diffie-hellman | Cryptography library

I'm using Jenkins version - 2.332.1 and i have problem with jenkins gerrit repository ssh clone. The details as follows,

I have a playbook that is launched from AWX with machine credentials, ie. with ssh_user_A. In this playbook, i need to perform a couple of tasks with another SSH user, ie. ssh_user_B.

In terms of credentials, I have:

• machine credentials for ssh_user_A that are OK, I can do whatever I need
• a public/private keys couple for ssh_user_B:
  • the public key is present on the remote host in the ~ssh_user_B/.ssh/authorized_keys file
  • if I test this public/private key with a temp machine credentials (not possible in final target) and a dummy playbook or an ad-hoc module call, it works I can do whatever I need

I change the SSH user in the playbook with these instructions:

I am having a problem connecting to some Checkpoint firewalls. They run a Linux, but I cannot install any Ansible.

we are currently working with a cloud product that uses JSCH internally to connect to external sftp sources. Im investigating an connection reset exception that we are getting when trying to connect to azure sftp.

Using wireshark i determined that the problem occurs after we send the Client: Key Exchange Init. Establishing the same connection with filezilla we dont have this issue.

comparing the packages from jsch and filezilla i didn't see an obivious issue, but im not an expert on the ssh protocol. im gonna post both requests below if somebody could give me any pointers it would be greatly appreciated.

Request with JSCH (not working)

Request with Filezilla (working)

Response with Filezilla (working)

See below for the log output:

I have ec2 instance with ubuntu v20.04 and it has python v3.8.10 and pysftp 0.2.9.

I have generate .pem file from .ppk file using below command

puttygen sftp_server.ppk -O private-openssh -o sftp_server.pem

I am able to connect successfully to sftp server using command line-

I have a Python 3 application running on CentOS Linux 7.7 executing SSH commands against remote hosts. It works properly but today I encountered an odd error executing a command against a "new" remote server (server based on RHEL 6.10):

encountered RSA key, expected OPENSSH key

Executing the same command from the system shell (using the same private key of course) works perfectly fine.

On the remote server I discovered in /var/log/secure that when SSH connection and commands are issued from the source server with Python (using Paramiko) sshd complains about unsupported public key algorithm:

userauth_pubkey: unsupported public key algorithm: rsa-sha2-512

Note that target servers with higher RHEL/CentOS like 7.x don't encounter the issue.

It seems like Paramiko picks/offers the wrong algorithm when negotiating with the remote server when on the contrary SSH shell performs the negotiation properly in the context of this "old" target server. How to get the Python program to work as expected?

Python code

I am trying to write a bash script that runs ssh command with debug (ssh -vvv) against a specified host/hosts. I am not trying to login to the server, but rather just trying to see what all kex, mac and ciphers does the server offer.

I did create a script to find the kex algos after negotiation using the -G option.

I'm trying to find a python equivalent of this js function:

We are in the process of setting up api gateway with Lamba function behind it. The setup uses aws cognito authorizer. We have the VPC endpoint for api gateway so that is reachable through private IP.

But cognito does not support private links so we can't have the VPC endpoint for it. So this means the token issued by Cognito has to travel from https://ourdomain.auth.ap-southeast-2.amazoncognito.com to client over the internet.

Cognito documentation says following for data in transit:-

" Encryption in transit

All requests to Amazon Cognito must be made over the Transport Layer Security protocol (TLS). Clients must support Transport Layer Security (TLS) 1.0 or later. We recommend TLS 1.2 or later. Clients must also support cipher suites with perfect forward secrecy (PFS) such as Ephemeral Diffie-Hellman (DHE) or Elliptic Curve Ephemeral Diffie-Hellman (ECDHE). Most modern systems such as Java 7 and later support these modes."

According to above the token should be encrypted.

But I have following questions:

• Is TLS (1.2) enforced for Cognito?

• with encryption in transit being available would security best practices still dictate having Cognito available through VPC endpoint so that the token does not need to travel on internet.

• if a client application is coming from on-prem environment and accessing the api then if we make it go through a proxy in AWS then will the traffic remain in AWS backbone network or still flow through internet?