reenable sha1 for sshd after update of omv 6.4.8

openmediavault : 6.5.0-2 (Shaitan)

On the beginning of july we updated our openmediavault from 6.2.9 or 6.4.7 to 6.4.8. We are running an older MF-printer/copier/scanner that uploads (uploaded without any problems) by SFTP all scaning files to our ovm installation. Since the update to ovm 6.4.8 we encouter the problem, that older sha1 key exchange methods are not anymore supported/enabled on the sshd of our updated omv installation. In the auth.log we can see those messages:

Jul 19 16:59:59 omv sshd[230763]: Unable to negotiate with our.printer.net port 43595: no matching key exchange method found. Their offer: diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 [preauth]

Normally those key methodes can be reenabled in the sshd_config file. Unfortunately this config file seems to be autogenerated and would be overwritten by omv:

# This file is auto-generated by openmediavault (https://www.openmediavault.org)
# WARNING: Do not edit this file, your changes will get lost.

So my question is, where can I put/add sshd config statements in order they are not overwritten by omv configurations scripts and omv future upgrades in order to reenable sha1 key echange methods?

Many thanks in advance and best regards,

Hello

Many thanks for your prompt response and the hint. Unfortunately I am not able to confirm the pending configuration change to the ssh service Extra options field to the omv installation. I have entred the following Extra options in order to append

KexAlgorithms to the defaults:

+KexAlgorithms diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1

By confirming the pending change to omv I get the error messages:

Failed to execute command 'export PATH=/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin; export LANG=C.UTF-8; export LANGUAGE=; omv-salt deploy run --no-color ssh 2>&1' with exit code '1': debian:
----------
          ID: disable_ssh_socket_activation
    Function: service.dead
        Name: ssh.socket
      Result: True
     Comment: The service ssh.socket is already dead
     Started: 10:23:29.395033
    Duration: 73.032 ms
     Changes:
----------
          ID: remove_ssh_authorized_keys
    Function: file.directory
        Name: /var/lib/openmediavault/ssh/authorized_keys
      Result: True
     Comment: Files cleaned from directory /var/lib/openmediavault/ssh/authorized_keys
     Started: 10:23:29.473124
    Duration: 8.041 ms
     Changes:
[...]

----------
          ID: configure_sshd_config
    Function: file.managed
        Name: /etc/ssh/sshd_config
      Result: True
     Comment: File /etc/ssh/sshd_config updated
     Started: 10:23:29.618308
    Duration: 109.532 ms
     Changes:
              ----------
              diff:
                  ---
                  +++
                  @@ -30,5 +30,4 @@
                   PasswordAuthentication yes
                   AuthorizedKeysFile .ssh/authorized_keys .ssh/authorized_keys2 /var/lib/openmediavault/ssh/authorized_keys/%u
                   PubkeyAuthentication yes
                  -+KexAlgorithms diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1
----------
[...]

Summary for debian
-------------
Succeeded: 34 (changed=33)
Failed:     1
-------------
Total states run:     35
Total run time:  561.437 ms
[ERROR   ] Command 'sshd' failed with return code: 255
[ERROR   ] stderr: Missing privilege separation directory: /run/sshd
[ERROR   ] retcode: 255
[ERROR   ] {'pid': 2157, 'retcode': 255, 'stdout': '', 'stderr': 'Missing privilege separation directory: /run/sshd'} in /usr/share/php/openmediavault/system/process.inc:220
Stack trace:

[...]

In the end sshd stops to run and I have to reverted to the previous setting and to restart omv.

I found in the actual documentation for the ssh service the following statement:

Quote

An extra text field is provided to enter more options. Examine first the
file /etc/ssh/sshd_config before adding extra options otherwise the
option will not be applied. In that case is necessary change the environmental variable.

I not sure what is the concrete meaning of this statment regarding to add a sshd command as "+KexAlgorithms".

Many thanks again for any hint,

best regards

So I solved the problem as there was a syntax error in the Extra options statement. The correct syntax is the following:

KexAlgorithms +diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1

The append sign "+" has to be in front of the key method definitions/names to be appended.

best regards