3

I have a twofold question about OpenSSH rekeying. I use OpenSSH 6.4 on the server side and the connection between client and server is a SSH2 connection.

The questions:

  • How do I know when a rekey has happened? Should I check any logs, or any specific output? Running sshd in debug more (-d) does not show me anything related to rekeying.
  • How can I trigger a rekey?
4

How do I know when a rekey has happened? Should I check any logs, or any specific output? Running sshd in debug more (-d) does not show me anything related to rekeying.

It is printed only in debug mode, because it should not be a think you should care about. It should work out of the box as it is. But anyway, you can increase log level from your client using:

  • -vvv switch to your ssh command (DEBUG3)
  • LogLevel DEBUG3 config option in your ~/.ssh/config
  • ~v escape sequence during your session

How can I trigger a rekey?

Rekey is handled by configuration option RekeyLimit in both client and server config (even though a bit broken until openssh-7.2). If you set up low value it should rekey more often, but there is no point in doing that.

By hand in session, you can trigger one, by escape sequence ~R. After that (in at least DEBUG log level or -v, you will see a lot of debug messages:

[root@f24 ~]# ~?
Supported escape sequences:
 ~.   - terminate connection (and any multiplexed sessions)
 ~B   - send a BREAK to the remote system
 ~C   - open a command line
 ~R   - request rekey
 ~V/v - decrease/increase verbosity (LogLevel)
 ~^Z  - suspend ssh
 ~#   - list forwarded connections
 ~&   - background ssh (when waiting for connections to terminate)
 ~?   - this message
 ~~   - send the escape character by typing it twice
(Note that escapes are only recognized immediately after newline.)

[root@f24 ~]# ~v [LogLevel VERBOSE]
~v [LogLevel DEBUG]
[root@f24 ~]# ~R
debug1: SSH2_MSG_KEXINIT sent
debug1: rekeying in progress
debug1: SSH2_MSG_KEXINIT received
debug1: kex: algorithm: curve25519-sha256@libssh.org
debug1: kex: host key algorithm: ecdsa-sha2-nistp256
debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: kex: curve25519-sha256@libssh.org need=64 dh_need=64
debug1: kex: curve25519-sha256@libssh.org need=64 dh_need=64
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: rekeying in progress
debug1: rekeying in progress
debug1: Server host key: ecdsa-sha2-nistp256 SHA256:E9HuzpVQJ/5DavNIZhWzJrADNj5Ntw69RJ1obXJtlGo
debug1: set_newkeys: rekeying, input 5156 bytes 167 blocks, output 5864 bytes 0 blocks
debug1: rekey after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: set_newkeys: rekeying, input 5168 bytes 0 blocks, output 5864 bytes 0 blocks
debug1: rekey after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS received
3

According to this stackexchange Question Does RekeyLimit property in sshd_config enforce re-keying / key re-exchange? you need to make debug more talkative (-ddd). The debug mode (even with a single -d) is sufficient. All you need to do is trigger the rekeying process.
When using OpenSSH as client, simply enter ~R (capital R!) and rekeying will take place. On server side you will see

debug1: SSH2_MSG_KEXINIT received
debug1: SSH2_MSG_KEXINIT sent
debug1: kex: client->server aes128-ctr hmac-md5 none
debug1: kex: server->client aes128-ctr hmac-md5 none
debug1: expecting SSH2_MSG_KEX_ECDH_INIT
debug1: set_newkeys: rekeying
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: set_newkeys: rekeying
debug1: SSH2_MSG_NEWKEYS received

When using PuTTY as client you can force rekeying by 'Special Command' -> 'Repeat Key Exchange' which will result in a similar server log:

debug1: SSH2_MSG_KEXINIT received
debug1: SSH2_MSG_KEXINIT sent
debug1: kex: client->server aes256-ctr hmac-sha2-256 none
debug1: kex: server->client aes256-ctr hmac-sha2-256 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST received
debug1: SSH2_MSG_KEX_DH_GEX_GROUP sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_INIT
debug1: SSH2_MSG_KEX_DH_GEX_REPLY sent
debug1: set_newkeys: rekeying
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: set_newkeys: rekeying
debug1: SSH2_MSG_NEWKEYS received
  • what about manually triggering one? can you do that? – Pandrei Apr 26 '16 at 15:20
  • 2
    @Pandrei see linked Question. There ~R is used. You could also just use google google.com/search?q=openssh+trigger+manual+rekeying (first hit, second post) – Alexander Stumpf Apr 26 '16 at 15:24
  • This is not the message that rekeying happened. It is message about scheduling rekey after 2048 bytes. See my answer where you can see how does rekey look like and how to see that from the client application (though server logs that similar way). – Jakuje Apr 26 '16 at 21:47
  • Thanks, @Jakuje, will update my post with the "server side view" (your post showed the client side) – Alexander Stumpf Apr 27 '16 at 10:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.