This is the mail archive of the
cygwin
mailing list for the Cygwin project.
problem with ~/.ssh/config ?
- From: Lee <ler762 at gmail dot com>
- To: cygwin at cygwin dot com
- Date: Tue, 15 Sep 2015 17:59:27 -0400
- Subject: problem with ~/.ssh/config ?
- Authentication-results: sourceware.org; auth=none
OpenSSH 7.0 defaults to no support for diffie-hellman-group1-sha1 key
exchange which is a problem with certain devices:
$ ssh 10.10.3.5
Unable to negotiate with 10.10.3.5: no matching key exchange method
found. Their offer: diffie-hellman-group1-sha1
http://www.openssh.com/legacy.html has two work-arounds:
1. add "-oKexAlgorithms=+diffie-hellman-group1-sha1" to the ssh
command -- which works for me
2. add "Host * KexAlgorithms +diffie-hellman-group1-sha1" to
~/.ssh/config -- which does not work for me
What's the trick for getting the KexAlgorithms param in ~/.ssh/config to work?
$ cat ~/.ssh/config
# ssh common params
# Protocol 2,1
# ??? still need version 1 compatability ???
# IOS devices running "Remote protocol version 1.99, remote software
version Cisco-1.25"
# only do diffie-hellman-group1-sha1 for key exchange & OpenSSH 7.0
has it disabled by default.
# re-enable & add to the end of the list:
Host * KexAlgorithms +diffie-hellman-group1-sha1
ServerAliveInterval 40
# Sets a timeout interval in seconds after which if no data has
# been received from the server, ssh(1) will send a message through
# the encrypted channel to request a response from the server.
ServerAliveCountMax 6
# Sets the number of server alive messages which may be
# sent without ssh(1) receiving any messages back from the server.
# If this threshold is reached while server alive messages are
# being sent, ssh will disconnect from the server, terminating the
# session.
TCPKeepAlive yes
# Specifies whether the system should send TCP keepalive messages
# to the other side. If they are sent, death of the connection or
# crash of one of the machines will be properly noticed. However,
# this means that connections will die if the route is down temporarily,
# and some people find it annoying.
~
add "-o" on command line: works
$ ssh -oKexAlgorithms=+diffie-hellman-group1-sha1 -G 10.10.3.5 | grep -i kex
kexalgorithms curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
"host * KexAlgorithms" in .ssh/config does not work:
$ ssh -G 10.10.3.5 | grep -i kex
kexalgorithms curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1
if it helps any, ssh with the -v option:
$ ssh -v 10.10.3.5
OpenSSH_7.0p1, OpenSSL 1.0.2d 9 Jul 2015
debug1: Reading configuration data /home/Lee/.ssh/config
debug1: /home/Lee/.ssh/config line 9: Applying options for *
debug1: Connecting to 10.10.3.5 [10.10.3.5] port 22.
debug1: Connection established.
debug1: key_load_public: No such file or directory
debug1: identity file /home/Lee/.ssh/id_rsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/Lee/.ssh/id_rsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/Lee/.ssh/id_dsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/Lee/.ssh/id_dsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/Lee/.ssh/id_ecdsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/Lee/.ssh/id_ecdsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/Lee/.ssh/id_ed25519 type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/Lee/.ssh/id_ed25519-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_7.0
debug1: Remote protocol version 2.0, remote software version Cisco-1.25
debug1: match: Cisco-1.25 pat Cisco-1.* compat 0x60000000
debug1: Authenticating to 10.10.3.5:22 as 'Lee'
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-cbc hmac-sha1 none
debug1: kex: client->server aes128-cbc hmac-sha1 none
Unable to negotiate with 10.10.3.5: no matching key exchange method
found. Their offer: diffie-hellman-group1-sha1
TIA,
Lee
--
Problem reports: http://cygwin.com/problems.html
FAQ: http://cygwin.com/faq/
Documentation: http://cygwin.com/docs.html
Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple