Cisco SSH key exchange fails from Ubuntu 14.04 (Client DH key range mismatch)
13,021
Solution 1
Found a workaround, the trick is to use a different KEX algo, as such;
$ ssh -v [email protected] -o KexAlgorithms=diffie-hellman-group14-sha1
There is a confirmed bug report at Cisco under (see CSCuo76464), and was discussed here.
There is also a bug report for openssh-client.
Many thanks to jlgaddis for figuring this out.
Solution 2
Or upgrade the cisco ios. I had this issue and ios upgrade does the trick
The bug filed against the Cisco ssh client is CSCuo76464
https://tools.cisco.com/bugsearch/bug/CSCuo76464
Solution 3
(config)#ip ssh dh min size 4096
Author by
sleepycal
Updated on June 11, 2022Comments
-
sleepycal almost 2 years
For some reason, I cannot SSH into a Cisco CSR1000v router from an Ubuntu 14.04 machine.
Our Cisco firmware is;
Cisco IOS XE Software, Version 03.12.00.S - Standard Support Release Cisco IOS Software, CSR1000V Software (X86_64_LINUX_IOSD-UNIVERSALK9-M), Version 15.4(2)S, RELEASE SOFTWARE (fc2)
The server error being displayed is;
%SSH-3-DH_RANGE_FAIL: Client DH key range mismatch with maximum configured DH key on server
The client error being displayed is;
$ ssh -v [email protected] OpenSSH_6.6.1, OpenSSL 1.0.1f 6 Jan 2014 debug1: Reading configuration data /etc/ssh/ssh_config debug1: /etc/ssh/ssh_config line 19: Applying options for * debug1: Connecting to 172.16.3.253 [172.16.3.253] port 22. debug1: Connection established. debug1: identity file /home/admin/.ssh/id_rsa type 1 debug1: identity file /home/admin/.ssh/id_rsa-cert type -1 debug1: identity file /home/admin/.ssh/id_dsa type -1 debug1: identity file /home/admin/.ssh/id_dsa-cert type -1 debug1: identity file /home/admin/.ssh/id_ecdsa type -1 debug1: identity file /home/admin/.ssh/id_ecdsa-cert type -1 debug1: identity file /home/admin/.ssh/id_ed25519 type -1 debug1: identity file /home/admin/.ssh/id_ed25519-cert type -1 debug1: Enabling compatibility mode for protocol 2.0 debug1: Local version string SSH-2.0-OpenSSH_6.6.1p1 Ubuntu-2ubuntu2 debug1: Remote protocol version 2.0, remote software version Cisco-1.25 debug1: no match: Cisco-1.25 debug1: SSH2_MSG_KEXINIT sent debug1: SSH2_MSG_KEXINIT received debug1: kex: server->client aes128-ctr hmac-sha1 none debug1: kex: client->server aes128-ctr hmac-sha1 none debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<7680<8192) sent debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP Connection closed by 172.16.3.253