ssh error: no matching host key type found. Their offer: ssh-rsa,ssh-dss

Your switch offered diffie-hellman-group14-sha1, the diffie-hellman-group1-sha1 came from cracauer@ copying from google.
 
anlashok said:
Your switch offered diffie-hellman-group14-sha1, the diffie-hellman-group1-sha1 came from cracauer@ copying from google.
Click to expand...
argh!
I totally missed that. In my own defense, I've spent way too many hours fighing with freaking certificates on my switches so I'm feeling a little brain dead. I'll change that!


scottro said:
I would also leave out the plus. I'm not expert enough on this to be sure, but I wonder if you'd be better off with
Host 192.168.0.0/24 HostKeyAlgorithms ssh-rsa, diffie-hellman-group1-sha1
but I'm not sure of the syntax. I'm guessing at the comma from an old archlinux forums post. https://bbs.archlinux.org/viewtopic.php?id=274584
Click to expand...
I tried it both ways. No difference I'm sad to say.

With "14" added I still get errors. Here's how that stanza looks now.

Host 192.168.0.0/24
HostKeyAlgorithms ssh-rsa
PubkeyAcceptedKeyTypes ssh-rsa
HostKeyAlgorithms +diffie-hellman-group14-sha1
user username
I tried with/without the + with the above and then tried the following:


Host 192.168.0.0/24
HostKeyAlgorithms ssh-rsa, +diffie-hellman-group14-sha1
PubkeyAcceptedKeyTypes ssh-rsa
user username
Again, with and without the + I keep getting the same errors:

/home/username/.ssh/config line 14: Bad key types '+diffie-hellman-group14-sha1'.
/home/usernam/.ssh/config: terminating, 1 bad configuration options

I do wish I could upgrade the ssh on the switches but that's not going to happen...at least not, with me doing it. I am going to send an email to the manufacturer and point out the problem and hopefully they'll upgrade it. But I'd still like to fix it on my FreeBSD box if possible.

Again, my thanks to everybody patiently trying to help me with this.
 
anlashok said:
"no matching key exchange method found. Their offer: diffie-hellman-group14-sha1"

given that, should it be

HostKeyAlgorithms +ssh-rsa
KexAlgorithms +diffie-hellman-group14-sha1

see also https://www.openssh.com/legacy.html
Click to expand...

So here's that stanza now

Host 192.168.0.0/24
HostKeyAlgorithms +ssh-rsa
KexAlgorithms +diffie-hellman-group14-sha1
user username

Here's the output.

Unable to negotiate with 192.168.0.10 port 22: no matching key exchange method found. Their offer: diffie-hellman-group14-sha1
 
what does your client support, there needs to be something that the client and switch both support
Code: 
ssh -Q cipher       # List supported ciphers
ssh -Q mac          # List supported MACs
ssh -Q key          # List supported public key types
ssh -Q kex          # List supported key exchange algorithms

and what does the client send to the switch when it tries to connect
Code: 
ssh -G username@192.168.0.10  # for example
 
anlashok said:
what does your client support, there needs to be something that the client and switch both support
Code: 
ssh -Q cipher       # List supported ciphers
ssh -Q mac          # List supported MACs
ssh -Q key          # List supported public key types
ssh -Q kex          # List supported key exchange algorithms

and what does the client send to the switch when it tries to connect
Code: 
ssh -G username@192.168.0.10  # for example
Click to expand...
I actually read through that page you linked. Some good info there.

Here's the output of the ssh -G command:
port 22
addressfamily any
batchmode no
canonicalizefallbacklocal yes
canonicalizehostname false
checkhostip no
compression no
controlmaster false
enablesshkeysign no
clearallforwardings no
exitonforwardfailure no
fingerprinthash SHA256
forwardx11 no
forwardx11trusted no
gatewayports no
gssapiauthentication no
gssapidelegatecredentials no
hashknownhosts no
hostbasedauthentication no
identitiesonly no
kbdinteractiveauthentication yes
nohostauthenticationforlocalhost no
passwordauthentication yes
permitlocalcommand no
proxyusefdpass no
pubkeyauthentication true
requesttty auto
sessiontype default
stdinnull no
forkafterauthentication no
streamlocalbindunlink no
stricthostkeychecking ask
tcpkeepalive yes
tunnel false
verifyhostkeydns false
visualhostkey no
updatehostkeys true
enableescapecommandline no
canonicalizemaxdots 1
connectionattempts 1
forwardx11timeout 1200
numberofpasswordprompts 3
serveralivecountmax 3
serveraliveinterval 0
requiredrsasize 1024
obscurekeystroketiming yes
ciphers chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com
hostkeyalgorithms ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,sk-ssh-ed25519-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-ed25519,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,sk-ssh-ed25519@openssh.com,sk-ecdsa-sha2-nistp256@openssh.com,rsa-sha2-512,rsa-sha2-256
hostbasedacceptedalgorithms ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,sk-ssh-ed25519-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-ed25519,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,sk-ssh-ed25519@openssh.com,sk-ecdsa-sha2-nistp256@openssh.com,rsa-sha2-512,rsa-sha2-256
kexalgorithms sntrup761x25519-sha512@openssh.com,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256
casignaturealgorithms ssh-ed25519,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,sk-ssh-ed25519@openssh.com,sk-ecdsa-sha2-nistp256@openssh.com,rsa-sha2-512,rsa-sha2-256
loglevel INFO
macs umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
securitykeyprovider internal
pubkeyacceptedalgorithms ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,sk-ssh-ed25519-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-ed25519,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,sk-ssh-ed25519@openssh.com,sk-ecdsa-sha2-nistp256@openssh.com,rsa-sha2-512,rsa-sha2-256,ssh-rsa
xauthlocation /usr/local/bin/xauth
identityfile ~/.ssh/id_rsa
identityfile ~/.ssh/id_ecdsa
identityfile ~/.ssh/id_ecdsa_sk
identityfile ~/.ssh/id_ed25519
identityfile ~/.ssh/id_ed25519_sk
identityfile ~/.ssh/id_xmss
identityfile ~/.ssh/id_dsa
canonicaldomains none
globalknownhostsfile /etc/ssh/ssh_known_hosts /etc/ssh/ssh_known_hosts2
userknownhostsfile /home/username/.ssh/known_hosts /home/username/.ssh/known_hosts2
logverbose none
permitremoteopen any
addkeystoagent false
forwardagent no
connecttimeout none
tunneldevice any:any
canonicalizePermittedcnames none
controlpersist no
escapechar ~
ipqos af21 cs1
rekeylimit 0 0
streamlocalbindmask 0177
syslogfacility USER

ssh -Q kex:
diffie-hellman-group1-sha1
diffie-hellman-group14-sha1
diffie-hellman-group14-sha256
diffie-hellman-group16-sha512
diffie-hellman-group18-sha512
diffie-hellman-group-exchange-sha1
diffie-hellman-group-exchange-sha256
ecdh-sha2-nistp256
ecdh-sha2-nistp384
ecdh-sha2-nistp521
curve25519-sha256
curve25519-sha256@libssh.org
sntrup761x25519-sha512@openssh.com


ssh -Q key:
ssh-ed25519
ssh-ed25519-cert-v01@openssh.com
sk-ssh-ed25519@openssh.com
sk-ssh-ed25519-cert-v01@openssh.com
ecdsa-sha2-nistp256
ecdsa-sha2-nistp256-cert-v01@openssh.com
ecdsa-sha2-nistp384
ecdsa-sha2-nistp384-cert-v01@openssh.com
ecdsa-sha2-nistp521
ecdsa-sha2-nistp521-cert-v01@openssh.com
sk-ecdsa-sha2-nistp256@openssh.com
sk-ecdsa-sha2-nistp256-cert-v01@openssh.com
ssh-dss
ssh-dss-cert-v01@openssh.com
ssh-rsa
ssh-rsa-cert-v01@openssh.com

and finally ssh -Q cipher:

3des-cbc
aes128-cbc
aes192-cbc
aes256-cbc
aes128-ctr
aes192-ctr
aes256-ctr
aes128-gcm@openssh.com
aes256-gcm@openssh.com
chacha20-poly1305@openssh.com

The output of the ssh -Q kex shows the diffie-hellman-group14-sha1 so I'm completely baffled. I confess, as much as I like FreeBSD, I'm no afficianado, ergo my confusions.
 
looks like the client doesn't offer the required KexAlgorithm to the switch when negotiating the initial connection
CptnBlues63 said:
kexalgorithms sntrup761x25519-sha512@openssh.com,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256
Click to expand...
does it work from the command line i.e. bypass the config file for now? The -v will add some verbosity to what it is trying, use -vv for even more info
Code: 
ssh -v -oKexAlgorithms=+diffie-hellman-group14-sha1 -oHostKeyAlgorithms=+ssh-dss username@hostname
 
anlashok said:
looks like the client doesn't offer the required KexAlgorithm to the switch when negotiating the initial connection

does it work from the command line i.e. bypass the config file for now? The -v will add some verbosity to what it is trying, use -vv for even more info
Code: 
ssh -v -oKexAlgorithms=+diffie-hellman-group14-sha1 -oHostKeyAlgorithms=+ssh-dss username@hostname
Click to expand...
That worked!

so for now I'm going to write a script that uses that command. Unless you can tell me how to fix things in my ~/.ssh/config file
 
I don't thinks SSH config supports CIDR notation for Host definitions, so you need to specify the IP ranges with wildcards, * for any 3 digits, or ? per digit.
Code: 
Host 192.168.0.*
HostKeyAlgorithms +ssh-rsa
KexAlgorithms +diffie-hellman-group14-sha1
user username

You can have different ranges and exclude some IP addresses in the same Host section.
Code: 
Host "192.168.0.*","192.168.2.*","!192.168.2.2*"
etc.

The ssh_config Match directive seems to allow for more complex pattern matching, but I've never done that so can't advise.
 
anlashok said:
I don't thinks SSH config supports CIDR notation for Host definitions, so you need to specify the IP ranges with wildcards, * for any 3 digits, or ? per digit.
Code: 
Host 192.168.0.*
HostKeyAlgorithms +ssh-rsa
KexAlgorithms +diffie-hellman-group14-sha1
user username

You can have different ranges and exclude some IP addresses in the same Host section.
Code: 
Host "192.168.0.*","192.168.2.*","!192.168.2.2*"
etc.

The ssh_config Match directive seems to allow for more complex pattern matching, but I've never done that so can't advise.
Click to expand...

Removing the CIDR notation and using a "*" fixed it and the ~/.ssh/config file is now working as it should. Thanks...........a lot!
 
You must log in or register to reply here.
Back
Top