1

I'm not sure if this problem caused by Lubuntu or Cisco Router side.

Lubuntu = 192.168.1.100
Cisco Router = 192.168.1.1

Ubuntu 18.04.4 LTS

user@linux:~$ lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description:    Ubuntu 18.04.4 LTS
Release:    18.04
Codename:   bionic
user@linux:~$ 

SSH Client: OpenSSH_7.6p1

user@linux:~$ ssh -V
OpenSSH_7.6p1 Ubuntu-4ubuntu0.3, OpenSSL 1.0.2n  7 Dec 2017
user@linux:~$

ssh -Q cipher

user@linux:~$ ssh -Q cipher
3des-cbc
aes128-cbc
aes192-cbc
aes256-cbc
rijndael-cbc@lysator.liu.se
aes128-ctr
aes192-ctr
aes256-ctr
aes128-gcm@openssh.com
aes256-gcm@openssh.com
chacha20-poly1305@openssh.com
user@linux:~$ 

ssh -Q mac

user@linux:~$ ssh -Q mac
hmac-sha1
hmac-sha1-96
hmac-sha2-256
hmac-sha2-512
hmac-md5
hmac-md5-96
umac-64@openssh.com
umac-128@openssh.com
hmac-sha1-etm@openssh.com
hmac-sha1-96-etm@openssh.com
hmac-sha2-256-etm@openssh.com
hmac-sha2-512-etm@openssh.com
hmac-md5-etm@openssh.com
hmac-md5-96-etm@openssh.com
umac-64-etm@openssh.com
umac-128-etm@openssh.com
user@linux:~$ 

ssh -Q kex

user@linux:~$ ssh -Q kex
diffie-hellman-group1-sha1
diffie-hellman-group14-sha1
diffie-hellman-group14-sha256
diffie-hellman-group16-sha512
diffie-hellman-group18-sha512
diffie-hellman-group-exchange-sha1
diffie-hellman-group-exchange-sha256
ecdh-sha2-nistp256
ecdh-sha2-nistp384
ecdh-sha2-nistp521
curve25519-sha256
curve25519-sha256@libssh.org
user@linux:~$ 

SSH from Lubuntu to Cisco Router

user@linux:~$ ssh admin@192.168.1.1
Unable to negotiate with 192.168.1.1 port 22: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1
user@linux:~$ 

This is on Cisco Router side

R1#
*Mar  1 01:41:19.631: SSH2 0: no matching cipher found: client chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,
R1#

SSH Verbose

user@linux:~$ ssh 192.168.1.1 -l admin -v
OpenSSH_7.6p1 Ubuntu-4ubuntu0.3, OpenSSL 1.0.2n  7 Dec 2017
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug1: Connecting to 192.168.1.1 [192.168.1.1] port 22.
debug1: Connection established.
debug1: key_load_public: No such file or directory
debug1: identity file /home/user/.ssh/id_rsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/user/.ssh/id_rsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/user/.ssh/id_dsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/user/.ssh/id_dsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/user/.ssh/id_ecdsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/user/.ssh/id_ecdsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/user/.ssh/id_ed25519 type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/user/.ssh/id_ed25519-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_7.6p1 Ubuntu-4ubuntu0.3
debug1: Remote protocol version 2.0, remote software version Cisco-1.25
debug1: match: Cisco-1.25 pat Cisco-1.* compat 0x60000000
debug1: Authenticating to 192.168.1.1:22 as 'admin'
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: algorithm: (no match)
Unable to negotiate with 192.168.1.1 port 22: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1
user@linux:~$ 

More Cisco Log

R1(config)#ip ssh logging events
R1(config)#
R1(config)#
*Mar  1 01:56:21.723: SSH2 0: no matching cipher found: client chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,
R1(config)#
*Mar  1 01:56:21.723: %SSH-5-SSH2_SESSION: SSH2 Session request from 192.168.1.100 (tty = 0) using crypto cipher '', hmac '' Failed
*Mar  1 01:56:21.723: %SSH-5-SSH2_CLOSE: SSH2 Session from 192.168.1.100 (tty = 0) for user '' using crypto cipher '', hmac '' closed
R1(config)#

I've also tried -oKexAlgorithms=+diffie-hellman-group1-sha1 but doesn't work as well.

user@linux:~$ ssh -oKexAlgorithms=+diffie-hellman-group1-sha1 -l admin 192.168.1.1
Unable to negotiate with 192.168.1.1 port 22: no matching cipher found. Their offer: aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc
user@linux:~$ 

What is the problem here and how to fix it?

  • 1
    please check if this help you: networkengineering.stackexchange.com/q/35312/16930 – JFL Mar 31 at 12:59
  • @JFL, tried that, same error – Sabrina Mar 31 at 13:07
  • Please edit the question to include the router configuration. – Ron Maupin Mar 31 at 13:36
  • If you tried JFL's suggestion and you get the same error, that means your host can't do diffie-helman key exchange. You either need to upgrade your host or the router. – Ron Trunk Mar 31 at 16:02
  • The problem appears to be on your host, which sadly, makes this question off topic here. you can try asking on Super User. – Ron Trunk Apr 4 at 13:25
1

Double-check your ssh client configuration. The output, below, is from an Ubuntu 18 VM that should be functionally identical to yours. It does support DH group 1 SHA1 for key exchange. If you invoke ssh with -oKexAlgorithms=+diffie-hellman-group1-sha1 it should fix that problem.

You may have OTHER PROBLEMS to fix afterward, e.g. key length or ciphers. Try adding -c aes128-cbc to your command line to enable an older, less-secure cipher, for example.

Ciphers & key exchanges your client should support:

vagrant@ubuntu18:~$ ssh -V
OpenSSH_7.6p1 Ubuntu-4ubuntu0.2, OpenSSL 1.0.2n  7 Dec 2017
vagrant@ubuntu18:~$ ssh -Q cipher
3des-cbc
aes128-cbc
aes192-cbc
aes256-cbc
rijndael-cbc@lysator.liu.se
aes128-ctr
aes192-ctr
aes256-ctr
aes128-gcm@openssh.com
aes256-gcm@openssh.com
chacha20-poly1305@openssh.com
vagrant@ubuntu18:~$ ssh -Q mac
hmac-sha1
hmac-sha1-96
hmac-sha2-256
hmac-sha2-512
hmac-md5
hmac-md5-96
umac-64@openssh.com
umac-128@openssh.com
hmac-sha1-etm@openssh.com
hmac-sha1-96-etm@openssh.com
hmac-sha2-256-etm@openssh.com
hmac-sha2-512-etm@openssh.com
hmac-md5-etm@openssh.com
hmac-md5-96-etm@openssh.com
umac-64-etm@openssh.com
umac-128-etm@openssh.com
vagrant@ubuntu18:~$ ssh -Q kex
diffie-hellman-group1-sha1
diffie-hellman-group14-sha1
diffie-hellman-group14-sha256
diffie-hellman-group16-sha512
diffie-hellman-group18-sha512
diffie-hellman-group-exchange-sha1
diffie-hellman-group-exchange-sha256
ecdh-sha2-nistp256
ecdh-sha2-nistp384
ecdh-sha2-nistp521
curve25519-sha256
curve25519-sha256@libssh.org
| improve this answer | |
  • Thanks Jeff, but -oKexAlgorithms=+diffie-hellman-group1-sha1 did not solve the problem. I've updated my question with more info. – Sabrina Apr 4 at 13:32
  • 1
    If you also add -c aes128-cbc as I recommended in the above answer, your connection should succeed. You have two problems. The first is the KexAlgorithms and the second is the data encryption algorithms. That's why you need to supply both arguments to work around the problems. – Jeff Wheeler Apr 5 at 15:57

Not the answer you're looking for? Browse other questions tagged or ask your own question.