SSH error with newer Cisco IOS versions
"Mathias Spoerr" <[email protected]> Wed, 18 May 2016 08:59:44 +0200
| Newsgroups | gmane.comp.encryption.cryptlib |
|---|---|
| Message-ID | <[email protected]> |
This is a multipart message in MIME format.
--===============3741306397771853855==
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_0006_01D1B0E3.9F778510"
Content-Language: de-at
This is a multipart message in MIME format.
------=_NextPart_000_0006_01D1B0E3.9F778510
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: 7bit
Hello,
it seems Cisco changed their SSH implementation recently and now I get
Cryptlib error-code "-41" (No data was read because the remote system closed
the connection (recv() == 0)) when connecting to such a device. Cisco SSH
debug output is as follows:
*May 17 13:46:16.964: SSH1: starting SSH control process
*May 17 13:46:16.964: SSH1: sent protocol version id SSH-2.0-Cisco-1.25
*May 17 13:46:16.967: SSH1: protocol version id is - SSH-2.0-cryptlib
*May 17 13:46:16.967: SSH2 1: kexinit sent: encryption algo =
aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc
*May 17 13:46:16.967: SSH2 1: kexinit sent: mac algo =
hmac-sha1,hmac-sha1-96
*May 17 13:46:16.967: SSH2 1: SSH2_MSG_KEXINIT sent
*May 17 13:46:16.972: SSH2 1: SSH2_MSG_KEXINIT received
*May 17 13:46:16.973: SSH2 1: kex: client->server enc:aes128-cbc
mac:hmac-sha1
*May 17 13:46:16.973: SSH2 1: kex: server->client enc:aes128-cbc
mac:hmac-sha1
*May 17 13:46:16.973: %SSH-3-NO_MATCH: No matching kex algorithm found:
client diffie-hellman-group-exchange-sha256 server
diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellma
n-group1-sha1
*May 17 13:46:17.072: SSH1: Session disconnected - error 0x00
Which setting on cryptlib side is needed to add the missing DH groups?
Thanks,
Mathias
------=_NextPart_000_0006_01D1B0E3.9F778510
Content-Type: text/html;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
<html xmlns:v=3D"urn:schemas-microsoft-com:vml" =
xmlns:o=3D"urn:schemas-microsoft-com:office:office" =
xmlns:w=3D"urn:schemas-microsoft-com:office:word" =
xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" =
xmlns=3D"http://www.w3.org/TR/REC-html40"><head><meta =
http-equiv=3DContent-Type content=3D"text/html; =
charset=3Dus-ascii"><meta name=3DGenerator content=3D"Microsoft Word 15 =
(filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 2.0cm 70.85pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext=3D"edit" spidmax=3D"1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext=3D"edit">
<o:idmap v:ext=3D"edit" data=3D"1" />
</o:shapelayout></xml><![endif]--></head><body lang=3DDE-AT =
link=3D"#0563C1" vlink=3D"#954F72"><div class=3DWordSection1><p =
class=3DMsoNormal><span lang=3DEN-US>Hello,<o:p></o:p></span></p><p =
class=3DMsoNormal><span lang=3DEN-US><o:p> </o:p></span></p><p =
class=3DMsoNormal><span lang=3DEN-US>it seems Cisco changed their SSH =
implementation recently and now I get Cryptlib error-code =
“-41” (No data was read because the remote system closed the =
connection (recv() =3D=3D 0)) when connecting to such a device. Cisco =
SSH debug output is as follows:<o:p></o:p></span></p><p =
class=3DMsoNormal><span lang=3DEN-US>*May 17 13:46:16.964: SSH1: =
starting SSH control process<o:p></o:p></span></p><p =
class=3DMsoNormal><span lang=3DEN-US>*May 17 13:46:16.964: SSH1: sent =
protocol version id SSH-2.0-Cisco-1.25<o:p></o:p></span></p><p =
class=3DMsoNormal><span lang=3DEN-US>*May 17 13:46:16.967: SSH1: =
protocol version id is - SSH-2.0-cryptlib<o:p></o:p></span></p><p =
class=3DMsoNormal><span lang=3DEN-US>*May 17 13:46:16.967: SSH2 1: =
kexinit sent: encryption algo =3D =
aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes192-cbc,aes256-cb=
c<o:p></o:p></span></p><p class=3DMsoNormal><span lang=3DEN-US>*May 17 =
13:46:16.967: SSH2 1: kexinit sent: mac algo =3D =
hmac-sha1,hmac-sha1-96<o:p></o:p></span></p><p class=3DMsoNormal><span =
lang=3DEN-US>*May 17 13:46:16.967: SSH2 1: SSH2_MSG_KEXINIT =
sent<o:p></o:p></span></p><p class=3DMsoNormal><span lang=3DEN-US>*May =
17 13:46:16.972: SSH2 1: SSH2_MSG_KEXINIT =
received<o:p></o:p></span></p><p class=3DMsoNormal><span =
lang=3DEN-US>*May 17 13:46:16.973: SSH2 1: kex: client->server =
enc:aes128-cbc mac:hmac-sha1 <o:p></o:p></span></p><p =
class=3DMsoNormal><span lang=3DEN-US>*May 17 13:46:16.973: SSH2 1: kex: =
server->client enc:aes128-cbc mac:hmac-sha1 <o:p></o:p></span></p><p =
class=3DMsoNormal><span lang=3DEN-US>*May 17 13:46:16.973: =
%SSH-3-NO_MATCH: No matching kex algorithm found: client =
diffie-hellman-group-exchange-sha256 server =
diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hel=
lman-group1-sha1<o:p></o:p></span></p><p class=3DMsoNormal><span =
lang=3DEN-US>*May 17 13:46:17.072: SSH1: Session disconnected - error =
0x00<o:p></o:p></span></p><p class=3DMsoNormal><span =
lang=3DEN-US><o:p> </o:p></span></p><p class=3DMsoNormal><span =
lang=3DEN-US>Which setting on cryptlib side is needed to add the missing =
DH groups?<o:p></o:p></span></p><p class=3DMsoNormal><span =
lang=3DEN-US><o:p> </o:p></span></p><p class=3DMsoNormal><span =
lang=3DEN-US>Thanks,<o:p></o:p></span></p><p class=3DMsoNormal><span =
lang=3DEN-US>Mathias<o:p></o:p></span></p><p class=3DMsoNormal><span =
lang=3DEN-US><o:p> </o:p></span></p><p class=3DMsoNormal><span =
lang=3DEN-US><o:p> </o:p></span></p></div></body></html>
------=_NextPart_000_0006_01D1B0E3.9F778510--
--===============3741306397771853855==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Content-Disposition: inline
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KQ3J5cHRsaWIg
bWFpbGluZyBsaXN0CkNyeXB0bGliQG1ic2tzLmZyYW5rZW4uZGVBZG1pbmlzdHJhdGlvbiB2aWEg
TWFpbDogY3J5cHRsaWItcmVxdWVzdEBtYnNrcy5mcmFua2VuLmRlCkFyY2hpdmU6IGZ0cDovL2Z0
cC5mcmFua2VuLmRlL3B1Yi9jcnlwdC9jcnlwdGxpYi9hcmNoaXZlcy8KaHR0cDovL25ld3MuZ21h
bmUub3JnL2dtYW5lLmNvbXAuZW5jcnlwdGlvbi5jcnlwdGxpYgpQb3N0cyBmcm9tIG5vbi1zdWJz
Y3JpYmVkIGFkZHJlc3NlcyBhcmUgYmxvY2tlZCB0byBwcmV2ZW50IHNwYW0sIHBsZWFzZQpzdWJz
Y3JpYmUgaW4gb3JkZXIgdG8gcG9zdCBtZXNzYWdlcy4K
--===============3741306397771853855==--