5

For some reason, I cannot SSH into a Cisco CSR1000v router from an Ubuntu 14.04 machine.

Our Cisco firmware is;

Cisco IOS XE Software, Version 03.12.00.S - Standard Support Release
Cisco IOS Software, CSR1000V Software (X86_64_LINUX_IOSD-UNIVERSALK9-M), Version 15.4(2)S, RELEASE SOFTWARE (fc2)

The server error being displayed is;

%SSH-3-DH_RANGE_FAIL: Client DH key range mismatch with maximum configured DH key on server

The client error being displayed is;

$ ssh -v admin@172.16.3.253
OpenSSH_6.6.1, OpenSSL 1.0.1f 6 Jan 2014
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug1: Connecting to 172.16.3.253 [172.16.3.253] port 22.
debug1: Connection established.
debug1: identity file /home/admin/.ssh/id_rsa type 1
debug1: identity file /home/admin/.ssh/id_rsa-cert type -1
debug1: identity file /home/admin/.ssh/id_dsa type -1
debug1: identity file /home/admin/.ssh/id_dsa-cert type -1
debug1: identity file /home/admin/.ssh/id_ecdsa type -1
debug1: identity file /home/admin/.ssh/id_ecdsa-cert type -1
debug1: identity file /home/admin/.ssh/id_ed25519 type -1
debug1: identity file /home/admin/.ssh/id_ed25519-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.6.1p1 Ubuntu-2ubuntu2
debug1: Remote protocol version 2.0, remote software version Cisco-1.25
debug1: no match: Cisco-1.25
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-ctr hmac-sha1 none
debug1: kex: client->server aes128-ctr hmac-sha1 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<7680<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
Connection closed by 172.16.3.253
3
  • Your question is offtopic here, but it would be ontopic on unix.stackexchange.com .
    – peterh
    Sep 16, 2015 at 4:46
  • @peterh This topic is nearly a year old, seems a bit pedantic to be trawling through the archives.....
    – SleepyCal
    Sep 16, 2015 at 11:40
  • sleepycal, I agree - but it could serve as a signpost for the googlers of the future. My heart bleeds if I need to vote for close, in cases similar to that I simply must do every possible to compensate the op.
    – peterh
    Sep 16, 2015 at 12:07

3 Answers 3

9

Found a workaround, the trick is to use a different KEX algo, as such;

$ ssh -v admin@172.16.3.253 -o KexAlgorithms=diffie-hellman-group14-sha1

There is a confirmed bug report at Cisco under (see CSCuo76464), and was discussed here.

There is also a bug report for openssh-client.

Many thanks to jlgaddis for figuring this out.

2

Or upgrade the cisco ios. I had this issue and ios upgrade does the trick

The bug filed against the Cisco ssh client is CSCuo76464

https://tools.cisco.com/bugsearch/bug/CSCuo76464

1

(config)#ip ssh dh min size 4096

2
  • 2
    Perhaps a sentence or two of explanation just might be in order.
    – tjd
    Feb 23, 2015 at 18:02
  • The newer clients request keys longer than that (7680), and configuring the length of e.g. 4096 on the router will result in an inability to connect at all - neither with the default SSH configuration, nor with the weaker ciphers from the CSCuo76464 log. I don't think this is such a hot idea. Apr 13, 2016 at 17:06

Not the answer you're looking for? Browse other questions tagged or ask your own question.