1

I'm not sure if this problem caused by Lubuntu or Cisco Router side.

Lubuntu = 192.168.1.100
Cisco Router = 192.168.1.1

Ubuntu 18.04.4 LTS

user@linux:~$ lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description:    Ubuntu 18.04.4 LTS
Release:    18.04
Codename:   bionic
user@linux:~$ 

SSH Client: OpenSSH_7.6p1

user@linux:~$ ssh -V
OpenSSH_7.6p1 Ubuntu-4ubuntu0.3, OpenSSL 1.0.2n  7 Dec 2017
user@linux:~$

ssh -Q cipher

user@linux:~$ ssh -Q cipher
3des-cbc
aes128-cbc
aes192-cbc
aes256-cbc
[email protected]
aes128-ctr
aes192-ctr
aes256-ctr
[email protected]
[email protected]
[email protected]
user@linux:~$ 

ssh -Q mac

user@linux:~$ ssh -Q mac
hmac-sha1
hmac-sha1-96
hmac-sha2-256
hmac-sha2-512
hmac-md5
hmac-md5-96
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
user@linux:~$ 

ssh -Q kex

user@linux:~$ ssh -Q kex
diffie-hellman-group1-sha1
diffie-hellman-group14-sha1
diffie-hellman-group14-sha256
diffie-hellman-group16-sha512
diffie-hellman-group18-sha512
diffie-hellman-group-exchange-sha1
diffie-hellman-group-exchange-sha256
ecdh-sha2-nistp256
ecdh-sha2-nistp384
ecdh-sha2-nistp521
curve25519-sha256
[email protected]
user@linux:~$ 

SSH from Lubuntu to Cisco Router

user@linux:~$ ssh [email protected]
Unable to negotiate with 192.168.1.1 port 22: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1
user@linux:~$ 

This is on Cisco Router side

R1#
*Mar  1 01:41:19.631: SSH2 0: no matching cipher found: client [email protected],aes128-ctr,aes192-ctr,aes256-ctr,[email protected],
R1#

SSH Verbose

user@linux:~$ ssh 192.168.1.1 -l admin -v
OpenSSH_7.6p1 Ubuntu-4ubuntu0.3, OpenSSL 1.0.2n  7 Dec 2017
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug1: Connecting to 192.168.1.1 [192.168.1.1] port 22.
debug1: Connection established.
debug1: key_load_public: No such file or directory
debug1: identity file /home/user/.ssh/id_rsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/user/.ssh/id_rsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/user/.ssh/id_dsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/user/.ssh/id_dsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/user/.ssh/id_ecdsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/user/.ssh/id_ecdsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/user/.ssh/id_ed25519 type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/user/.ssh/id_ed25519-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_7.6p1 Ubuntu-4ubuntu0.3
debug1: Remote protocol version 2.0, remote software version Cisco-1.25
debug1: match: Cisco-1.25 pat Cisco-1.* compat 0x60000000
debug1: Authenticating to 192.168.1.1:22 as 'admin'
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: algorithm: (no match)
Unable to negotiate with 192.168.1.1 port 22: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1
user@linux:~$ 

More Cisco Log

R1(config)#ip ssh logging events
R1(config)#
R1(config)#
*Mar  1 01:56:21.723: SSH2 0: no matching cipher found: client [email protected],aes128-ctr,aes192-ctr,aes256-ctr,[email protected],
R1(config)#
*Mar  1 01:56:21.723: %SSH-5-SSH2_SESSION: SSH2 Session request from 192.168.1.100 (tty = 0) using crypto cipher '', hmac '' Failed
*Mar  1 01:56:21.723: %SSH-5-SSH2_CLOSE: SSH2 Session from 192.168.1.100 (tty = 0) for user '' using crypto cipher '', hmac '' closed
R1(config)#

I've also tried -oKexAlgorithms=+diffie-hellman-group1-sha1 but doesn't work as well.

user@linux:~$ ssh -oKexAlgorithms=+diffie-hellman-group1-sha1 -l admin 192.168.1.1
Unable to negotiate with 192.168.1.1 port 22: no matching cipher found. Their offer: aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc
user@linux:~$ 

What is the problem here and how to fix it?

6
  • 1
    please check if this help you: networkengineering.stackexchange.com/q/35312/16930
    – JFL
    Mar 31, 2020 at 12:59
  • @JFL, tried that, same error
    – Sabrina
    Mar 31, 2020 at 13:07
  • Please edit the question to include the router configuration.
    – Ron Maupin
    Mar 31, 2020 at 13:36
  • If you tried JFL's suggestion and you get the same error, that means your host can't do diffie-helman key exchange. You either need to upgrade your host or the router.
    – Ron Trunk
    Mar 31, 2020 at 16:02
  • The problem appears to be on your host, which sadly, makes this question off topic here. you can try asking on Super User.
    – Ron Trunk
    Apr 4, 2020 at 13:25

1 Answer 1

1

Double-check your ssh client configuration. The output, below, is from an Ubuntu 18 VM that should be functionally identical to yours. It does support DH group 1 SHA1 for key exchange. If you invoke ssh with -oKexAlgorithms=+diffie-hellman-group1-sha1 it should fix that problem.

You may have OTHER PROBLEMS to fix afterward, e.g. key length or ciphers. Try adding -c aes128-cbc to your command line to enable an older, less-secure cipher, for example.

Ciphers & key exchanges your client should support:

vagrant@ubuntu18:~$ ssh -V
OpenSSH_7.6p1 Ubuntu-4ubuntu0.2, OpenSSL 1.0.2n  7 Dec 2017
vagrant@ubuntu18:~$ ssh -Q cipher
3des-cbc
aes128-cbc
aes192-cbc
aes256-cbc
[email protected]
aes128-ctr
aes192-ctr
aes256-ctr
[email protected]
[email protected]
[email protected]
vagrant@ubuntu18:~$ ssh -Q mac
hmac-sha1
hmac-sha1-96
hmac-sha2-256
hmac-sha2-512
hmac-md5
hmac-md5-96
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
vagrant@ubuntu18:~$ ssh -Q kex
diffie-hellman-group1-sha1
diffie-hellman-group14-sha1
diffie-hellman-group14-sha256
diffie-hellman-group16-sha512
diffie-hellman-group18-sha512
diffie-hellman-group-exchange-sha1
diffie-hellman-group-exchange-sha256
ecdh-sha2-nistp256
ecdh-sha2-nistp384
ecdh-sha2-nistp521
curve25519-sha256
[email protected]
2
  • Thanks Jeff, but -oKexAlgorithms=+diffie-hellman-group1-sha1 did not solve the problem. I've updated my question with more info.
    – Sabrina
    Apr 4, 2020 at 13:32
  • 1
    If you also add -c aes128-cbc as I recommended in the above answer, your connection should succeed. You have two problems. The first is the KexAlgorithms and the second is the data encryption algorithms. That's why you need to supply both arguments to work around the problems. Apr 5, 2020 at 15:57

Not the answer you're looking for? Browse other questions tagged or ask your own question.