Cisco ASA5505/6 - public key authentication does not work with OpenSSH client

Question

I have been unsuccessful at getting public key authentication to work per Cisco Systems on any of our ASA5505 or ASA5506 routers. Despite my best research and efforts, I still get challenged for a password.

Update: After input from FrameHowitzer, I tried connecting using Putty and that worked fine. So the issue appears to be with OpenSSH_8.9p1.

Our ASA5505s are running ASA 9.2(4) and ASA5506s are running ASA 9.8(2). All have the Security Plus License.

Typical configuration for a 5505:

ssh scopy enable
no ssh stricthostkeycheck
ssh timeout 60
ssh version 2
ssh key-exchange group dh-group14-sha1
ssh 10.2.0.0 255.255.255.0 TempMgmt
username scp password OpenSezzaMe privilege 15
aaa authentication ssh console LOCAL
username scp attributes
ssh authentication pkf
---- BEGIN SSH2 PUBLIC KEY ----
AAAAB3NzaC1yc2EAAAADAQABAAAAgQDJf/+4DKo2g64611G5iyK5Qh24ytbCqOlAKlrDp7
AwxpVcrtBUCKu131Sj7B9RCV6QG9Jg4lOGx53zfBxRcE1cJ0p2n26nHwfIRHIhEeS4B8J1
o8DOmAQ8oJWGesadx2Kq4mzEYJ7XrW8lgNTJCe+yJ6MMos6XGVFRqyaaheHUEQ==
---- END SSH2 PUBLIC KEY ----
quit

If I enable debugging for ssh and log in:

Device ssh opened successfully.
SSH0: SSH client: IP = '10.2.0.2'  interface # = 2
SSH: host key initialised
SSH0: starting SSH control process
SSH0: Exchanging versions - SSH-2.0-Cisco-1.25

SSH0: send SSH message: outdata is NULL

server version string:SSH-2.0-Cisco-1.25
SSH0: receive SSH message: 83 (83)
SSH0: client version is - SSH-2.0-OpenSSH_8.9p1 Ubuntu-3

client version string:SSH-2.0-OpenSSH_8.9p1 Ubuntu-3

SSH2 0: SSH2_MSG_KEXINIT sent
SSH2 0: SSH2_MSG_KEXINIT received
SSH2: kex: client->server aes128-ctr hmac-sha1 none
SSH2: kex: server->client aes128-ctr hmac-sha1 none
SSH2 0: expecting SSH2_MSG_KEXDH_INIT
SSH2 0: SSH2_MSG_KEXDH_INIT received
SSH2 0: signature length 143
SSH2: kex_derive_keys complete
SSH2 0: newkeys: mode 1
SSH2 0: SSH2_MSG_NEWKEYS sent
SSH2 0: waiting for SSH2_MSG_NEWKEYS
SSH2 0: newkeys: mode 0
SSH2 0: SSH2_MSG_NEWKEYS receivedSSH(scp): user authen method is 'use AAA', aaa server group ID = 1
SSH(scp): user authen method is 'use AAA', aaa server group ID = 1

SSH2 0: authentication successful for scp
SSH2 0: channel open request
SSH2 0: pty-req request
SSH2 0: requested tty: xterm-256color, height 26, width 140

SSH2 0: env request
SSH2 0: shell request
SSH2 0: shell message received

The user authen method is 'use AAA', aaa server group ID = 1 looks wrong to me. It should not be using aaa, I would think. But I can find no means of defining user authentication methods.

I have tried:

using "nopassword" - still get prompted for a password (which is "").
disabling aaa - I still get prompted for a password only, of course, it no longer works.
various client keypair lengths: 1024,2048,4096
various ASA keypair lengths (up to 2048)

We no longer have service agreements with Cisco and I would not reestablish them solely to fix this nagging issue.

"I tried connecting using Putty and that worked fine." The OpenSSH vendor does not offer optional, paid support, which is a requirement to be on-topic here. The problem is with off-topic software. Other software (Putty, SecureCRT, etc.) works just fine with the ASA, meaning the problem is with the off-topic product, not the on-topic ASA. — Ron Maupin, Commented Dec 31, 2022 at 4:44
@RonMaupin Seems to be more of an ASA issue than caused by OpenSSH. — Zac67, Commented Dec 31, 2022 at 19:48
@Zac67, our firewall guys use a variety of applications to do this with no problems, but OpenSSH is banned because of various problems. If other applications work fine with ASAs, why is it not an OpenSSH problem? — Ron Maupin, Commented Jan 1, 2023 at 18:53
@RonMaupin Any way, tools used by network professionals are on topic here and OpenSSH is used by some professionals, even if you've chosen to avoid it. — Zac67, Commented Jan 1, 2023 at 20:13
@Zac67, I chose my wording poorly. This really is not an issue with OpenSSH. It works fine and allows the automation (via bash, perl, cron,..) to manage large numbers of ASAs, Cisco Switches, and the such. But OpenSSH DOES require special configuration to accommodate the legacy algorithms present on the ASA5505/6. Call me biased, but I think it is worth the trouble. — Frobozz, Commented Jan 1, 2023 at 21:56

Frobozz · Accepted Answer · 2022-12-31 17:05:42Z

The ASA5505/6 units I tested, versions 9.2(4) and 9.8(2), require "ssh-rsa" be among the available signature algorithms for public key exchange regardless of the SSH client software you use.

Putty apparently has this available by default. OpenSSH has begun deprecating many of these older algorithms.

Debug of the OpenSSH Client reveals:

$ ssh -v asa5505-tmp
OpenSSH_8.9p1 Ubuntu-3, OpenSSL 3.0.2 15 Mar 2022
...
debug1: send_pubkey_test: no mutual signature algorithm
debug2: we did not send a packet, disable method
debug1: Next authentication method: password

I was aware the ASA550Xs require deprecated Key Exchange Algorithms and Host Key Algorithms be used for OpenSSH just to connect. But I overlooked the Public Key Algorithm.

The following is an ssh configuration example for use with the ASAs:

# ~/.ssh/config
Host "asa550*"

        # Required for ssh/scp
        KexAlgorithms +diffie-hellman-group14-sha1
        HostKeyAlgorithms +ssh-rsa

        # May be required soon
        # Ciphers +aes128-cbc

        # Required for public key authentication
        PubkeyAcceptedAlgorithms +ssh-rsa

        # Specify a default asa user and dedicated key-pair
        User scp
        IdentityFile ~/.ssh/id_asa

As all of these cyphers/algorithms are slowly being deprecated for security reasons, it is prudent to limit their use to just those targets that still require them. Likewise, you should use a dedicated identity (key-pair files) to help further mitigate exposure.

Thanks for the nudge in the right direction, @FrameHowitzer. — Frobozz, Commented Dec 31, 2022 at 4:40

FrameHowitzer · Accepted Answer · 2022-12-31 00:03:44Z

Basically follow this guide and it should work.

https://ip-life.net/cisco-asa-ssh-public-key-authentication/

Make sure your terminal client software is set to use SSH key as the primary/only method of authentication and it should do so.

I mocked this up following that guide on an ASA 5505 running version 9.1.7(32) and it worked great.

I added the attributes config to add the public key to a username and I set my client to use the matching private key and username and set the client to only use SSH Key exchange instead of password or keyboard interactive and it worked great.

I then removed the line for the aaa authentication for ssh and console to use the LOCAL group.

no aaa authentication ssh console LOCAL

Worked fine.

This is the debug output I get using 'debug ssh 10'

Device ssh opened successfully.
SSH1: SSH client: IP = '10.10.80.69'  interface # = 3
SSH: host key initialised
SSH1: starting SSH control process
SSH1: Exchanging versions - SSH-2.0-Cisco-1.25

SSH1: send SSH message: outdata is NULL

server version string:SSH-2.0-Cisco-1.25
SSH1: receive SSH message: 83 (83)
SSH1: client version is - SSH-2.0-SecureCRT_8.7.2 (x64 build 2214)

client version string:SSH-2.0-SecureCRT_8.7.2 (x64 build 2214)

SSH2 1: SSH2_MSG_KEXINIT sent
SSH2 1: SSH2_MSG_KEXINIT received
SSH2: kex: client->server aes128-ctr hmac-sha1 none
SSH2: kex: server->client aes128-ctr hmac-sha1 none
SSH2 1: expecting SSH2_MSG_KEXDH_INIT
SSH2 1: SSH2_MSG_KEXDH_INIT received
SSH2 1: signature length 271
SSH2: kex_derive_keys complete
SSH2 1: newkeys: mode 1
SSH2 1: SSH2_MSG_NEWKEYS sent
SSH2 1: waiting for SSH2_MSG_NEWKEYS
SSH2 1: newkeys: mode 0
SSH2 1: SSH2_MSG_NEWKEYS receivedSSH(pix): user authen method is 'no AAA', aaa server group ID = 0
SSH(pix): user authen method is 'no AAA', aaa server group ID = 0

SSH2 0: key lookup succeeded
SSH2 1: Sent SSH2_MSG_USERAUTH_PK_OK to clientSSH(pix): user authen method is 'no AAA', aaa server group ID = 0

public key pkt

[really long key stuff]

SSH2 0: key lookup succeeded
SSH2 0: Signature verification succeeded
SSH2 1: Public key authentication succeeded for user (pix)
SSH2 1: authentication successful for pix
SSH2 1: channel open request
SSH2 1: pty-req request
SSH2 1: requested tty: vt100, height 44, width 127

SSH2 1: [email protected] request
SSH2 1: shell request
SSH2 1: shell message received

Make sure your terminal client is set to try the key method first or only and then you just have to make sure the keys match up. As long as the key on the user on the ASA is a match to the key on your client, it should work whether the ASA has other methods available or not. Removing the AAA config line disables the ability to use the local password but the key works regardless because it is defined in the user attributes.

Installed putty (usually only use it from Windows - pretty unix centric these days) and it works just fine. Does not help me of course because my sole purpose in getting this working is automating ASA maintenance. Thanks for the help, @FrameHowitzer. — Frobozz, Commented Dec 31, 2022 at 1:47
@Frobozz, if Putty works, it is a problem with your application, and that is off-topic here. You could try to ask about that on Server Fault. You should accept the answer in order to prevent the question from popping up forever. — Ron Maupin, Commented Dec 31, 2022 at 2:29
@RonMaupin, the issue is with OpenSSH BUT is peculiar to Cisco's ASAs because they are running VERY old protocols with no hope of being updated. In my opinion, this forum is where the question is going to be asked in the future. — Frobozz, Commented Dec 31, 2022 at 3:58
@Frobozz, since the problem is with an off-topic application, we really cannot help you. That really makes the question off-topic here, and someone will probably vote to close the question. I am offering you the chance to reward someone who spent uncompensated time to help you before the question gets closed. — Ron Maupin, Commented Dec 31, 2022 at 4:03
@RonMaupin, I don't know why you keep saying this is off-topic. It's SSH and ASAs - what is more network engineering than that? — Frobozz, Commented Dec 31, 2022 at 4:32

Stack Exchange Network

Cisco ASA5505/6 - public key authentication does not work with OpenSSH client

2 Answers 2

Your Answer

Not the answer you're looking for? Browse other questions tagged
cisco-asa
ssh
or ask your own question.

Hot Network Questions

Cisco ASA5505/6 - public key authentication does not work with OpenSSH client

2 Answers 2

Your Answer

Sign up or log in

Post as a guest

Not the answer you're looking for? Browse other questions tagged cisco-asassh or ask your own question.

Related

Hot Network Questions

Not the answer you're looking for? Browse other questions tagged
cisco-asa
ssh
or ask your own question.