How to decrypt SSH messages in Wireshark

Questions / Help
,
1

I have written an Erlang application to send data over SSH to a server. The Erlang application acts as client in my setup. The client uses OTP ssh module. It uses various ssh functions such as ssh:connect, ssh_connection:session_channel & ssh_connection:send.

In order to debug an issue, I am using Wireshark application to check the packets exchanged between the client and server.

I see packets in Wireshark for all steps performed by the client. Most of these packets are encrypted by SSHV2.

In order to decrypt, I need to specify the required file in Wireshark, which contains private key, etc. Where can I find the private key?

I tried to find the details using available ssh function such as ssh:connection_info. But, I could find the private key.

(node1@vm-alarm)6> ssh:connection_info(Client).
[{client_version,{{2,0},"SSH-2.0-Erlang/4.15.3"}},
 {server_version,{{2,0},"SSH-2.0-Erlang/4.9.1.3"}},
 {peer,{"10.0.2.15",{{10,0,2,15},2022}}},
 {user,"admin"},
 {sockname,{{10,0,2,15},35022}},
 {options,[{password,not_ok},
           {pref_public_key_algs,['ecdsa-sha2-nistp384',
                                  'ecdsa-sha2-nistp521','ecdsa-sha2-nistp256','ssh-ed25519',
                                  'ssh-ed448','rsa-sha2-256','rsa-sha2-512']},
           {user,"admin"}]},
 {algorithms,[{kex,'ecdh-sha2-nistp256'},
              {hkey,'ssh-ed25519'},
              {send_mac,'chacha20-poly1305@openssh.com'},
              {recv_mac,'chacha20-poly1305@openssh.com'},
              {encrypt,'chacha20-poly1305@openssh.com'},
              {decrypt,'chacha20-poly1305@openssh.com'},
              {compress,none},
              {decompress,none},
              {send_ext_info,false},
              {recv_ext_info,true}]},
 {channels,[[{type,"session"},
             {sys,"none"},
             {user,<0.90.0>},
             {flow_control,undefined},
             {local_id,0},
             {recv_window_size,425984},
             {recv_window_pending,0},
             {recv_packet_size,65536},
             {recv_close,false},
             {remote_id,0},
             {send_window_size,655360},
             {send_packet_size,65536},
             {sent_close,false},
             {send_buf,{[],[]}}]]}]
1 Like
2

SSH looks for “~/.ssh/id_<alogrithm>” (at least on UNIX), e.g. “~/.ssh/id_rsa” usually contains private key for ssh using rsa encryption and that is what you’re probably looking for. You can read more about SSH configuration here here.

3 Likes