Known Issues on JUDAC

This page collects known issues affecting JUDAC’s system and application software.

Note

The following list of known issue is intended to provide a quick reference for users experiencing problems on JUDAC. We strongly encourage all users to report the occurrence of problems, whether listed below or not, to the user support.

Open Issues

MAC algorithm related SSH connection issues from Windows

Added: 2024-01-23

Affects: All systems at JSC

Description: On December 20, as a defense against the Terrapin Attack, JSC disabled several cryptographic algorithms involved in establishing SSH connections. Among the algorithms disabled was the ChaCha20-Poly1305 suite which up to that point was the algorithm chosen for most connections. With ChaCHa20-Poly1305 no longer available, the next MAC algorithm in line is umac-128-etm@openssh.com. Unfortunately, this particular algorithm seems to have issues on Windows:

• https://github.com/PowerShell/Win32-OpenSSH/issues/2078

• https://github.com/libressl/portable/issues/603

These issues will result in failed connection attempts with error messages like this:

Corrupted MAC on input.
ssh_dispatch_run_fatal: Connection to x.x.x.x port 22: message authentication code incorrect

Status: Open.

Workaround/Suggested Action: Until a fix is available for OpenSSH for Windows, we recommend to disable the offending MAC algorithms by adding the following snippet to the SSH configuration file (in .ssh\config in your user directory):

Host *
   MACs -umac-128-etm@openssh.com,umac-128@openssh.com

Cannot connect using old OpenSSH clients

Added: 2020-06-15

Affects: All systems at JSC

Description: In response to the recent security incident, the SSH server on JUDAC has been configured to only use modern cryptography algorithms. As a side effect, it is no longer possible to connect to JUDAC using older SSH clients. For OpenSSH, at least version 6.7 released in 2014 is required. Some operating systems with very long term support ship with older versions, e.g. RHEL 6 ships with OpenSSH 5.3.

Status: Open.

Workaround/Suggested Action: Use a more recent SSH client with support for the newer cryptography algorithms. If you cannot update the OpenSSH client (e.g. because you are not the administrator of the system you are trying to connect from) you can install your own version of OpenSSH from https://www.openssh.com. Logging in from a different system with a newer SSH client is another option. If you have to transfer data from a system with an old SSH client to JUDAC (e.g. using scp) you may have to transfer the data to a third system with a newer SSH client first (scp’s command line option -3 can be used to automate this).

Recently Resolved and Closed Issues