up vote 1 down vote favorite
1
share [g+] share [fb]

I was studying the packets exchanged in ssh protocol using wireshark and i noticed that TCP connection is getting established and keys are exchanged, before i accept the server certificate. Isn't it that server has to be authenticated before establishing a connection? The capture shown below is before accepting or rejecting the certificate.

Link to capture image. Sorry, I didn't have privileges to post image here

http://dl.dropbox.com/u/2558114/serverfault.JPG

PS

1. SSH certificate cache was cleared.
2. Certificate was rejected.
link|improve this question
feedback

1 Answer

up vote 2 down vote accepted

A TCP connection has to be established before any sort of conversation can take place between hosts, but it is purely for purposes of carrying higher layer traffic and does not do anything more than facilitate that conversation. If the certificate is rejected then the conversation is terminated.

link|improve this answer
Yeah, but why the keys are exchanged?, And the certificate window gave me three options,"yes", "no", "cancel". Selecting "no" would mean rejection, right?, But i was still able to login. The connection was terminated only when i selected "cancel". – Ankit Jun 4 '11 at 22:07
1  
Try running SSH with -v, if you are connecting from a linux host (I'm not sure about Windows versions of ssh) it will show you the authentication process and probably match up well with the packet exchange you have seen in wireshark. – blankabout Jun 4 '11 at 22:33
@Ankit: In PuTTY, the certificate window itself tells you that "Yes" means "Connect and remember key", "No" means "Connect and do not remember key", and "Cancel" means "Cancel the connection". – grawity Jun 4 '11 at 23:02
Thanks, -v showed very useful information, Almost everything in much simpler form than wireshark. And yes, wireshark generated the same output, but in linux it asked me whether or not to continue connection as the server was not trusted. Also, initial exchange is just algorithm negotiation. Random number for session keys are exchanged after accepting the certificate. – Ankit Jun 4 '11 at 23:18
Now i think i understand ssh better, but still need to work on it. Thanks for your help. – Ankit Jun 4 '11 at 23:19
show 1 more comment
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.