Dismiss
Announcing Stack Overflow Documentation

We started with Q&A. Technical documentation is next, and we need your help.

Whether you're a beginner or an experienced developer, you can contribute.

Sign up and start helping → Learn more about Documentation →

For some reason, I cannot SSH into a Cisco CSR1000v router from an Ubuntu 14.04 machine.

Our Cisco firmware is;

Cisco IOS XE Software, Version 03.12.00.S - Standard Support Release
Cisco IOS Software, CSR1000V Software (X86_64_LINUX_IOSD-UNIVERSALK9-M), Version 15.4(2)S, RELEASE SOFTWARE (fc2)

The server error being displayed is;

%SSH-3-DH_RANGE_FAIL: Client DH key range mismatch with maximum configured DH key on server

The client error being displayed is;

$ ssh -v admin@172.16.3.253
OpenSSH_6.6.1, OpenSSL 1.0.1f 6 Jan 2014
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug1: Connecting to 172.16.3.253 [172.16.3.253] port 22.
debug1: Connection established.
debug1: identity file /home/admin/.ssh/id_rsa type 1
debug1: identity file /home/admin/.ssh/id_rsa-cert type -1
debug1: identity file /home/admin/.ssh/id_dsa type -1
debug1: identity file /home/admin/.ssh/id_dsa-cert type -1
debug1: identity file /home/admin/.ssh/id_ecdsa type -1
debug1: identity file /home/admin/.ssh/id_ecdsa-cert type -1
debug1: identity file /home/admin/.ssh/id_ed25519 type -1
debug1: identity file /home/admin/.ssh/id_ed25519-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.6.1p1 Ubuntu-2ubuntu2
debug1: Remote protocol version 2.0, remote software version Cisco-1.25
debug1: no match: Cisco-1.25
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-ctr hmac-sha1 none
debug1: kex: client->server aes128-ctr hmac-sha1 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<7680<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
Connection closed by 172.16.3.253
share|improve this question

closed as off-topic by Andrew Medico, Yu Hao, peterh, Pranav C Balan, Cristik Sep 16 '15 at 6:06

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions on professional server- or networking-related infrastructure administration are off-topic for Stack Overflow unless they directly involve programming or programming tools. You may be able to get help on Server Fault." – Andrew Medico, Yu Hao, peterh, Pranav C Balan, Cristik
If this question can be reworded to fit the rules in the help center, please edit the question.

    
Your question is offtopic here, but it would be ontopic on unix.stackexchange.com . – peterh Sep 16 '15 at 4:46
    
@peterh This topic is nearly a year old, seems a bit pedantic to be trawling through the archives..... – sleepycal Sep 16 '15 at 11:40
    
sleepycal, I agree - but it could serve as a signpost for the googlers of the future. My heart bleeds if I need to vote for close, in cases similar to that I simply must do every possible to compensate the op. – peterh Sep 16 '15 at 12:07
up vote 8 down vote accepted

Found a workaround, the trick is to use a different KEX algo, as such;

$ ssh -v admin@172.16.3.253 -o KexAlgorithms=diffie-hellman-group14-sha1

There is a confirmed bug report at Cisco under (see CSCuo76464), and was discussed here.

There is also a bug report for openssh-client.

Many thanks to jlgaddis for figuring this out.

share|improve this answer

Or upgrade the cisco ios. I had this issue and ios upgrade does the trick

The bug filed against the Cisco ssh client is CSCuo76464

https://tools.cisco.com/bugsearch/bug/CSCuo76464

share|improve this answer

(config)#ip ssh dh min size 4096

share|improve this answer
2  
Perhaps a sentence or two of explanation just might be in order. – tjd Feb 23 '15 at 18:02
    
The newer clients request keys longer than that (7680), and configuring the length of e.g. 4096 on the router will result in an inability to connect at all - neither with the default SSH configuration, nor with the weaker ciphers from the CSCuo76464 log. I don't think this is such a hot idea. – Peter Turner Apr 13 at 17:06

Not the answer you're looking for? Browse other questions tagged or ask your own question.