Cisco Small Business Switches and modern SSH
Recently I had an issue where my switches at home where no longer backupped using rancid. I have multiple types of Cisco Small Business switches at home:
Apparently rancid could no longer SSH to them. When checking myself I also noticed that SSH did no longer work, but telnet still did.
For the switches I already had turned on support for older algorithms by having a ~/.ssh/config for the rancid user.
Host * KexAlgorithms +diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,diffie-hellman-group14-sha1 HostKeyAlgorithms +ssh-rsa
However this still made the SSH connection break. When turning on debugging in the OpenSSH client (9.6p1 on Ubuntu 24.04.4) it seems that the connection stalled after sending the SSH2_MSG_KEXINIT:
debug1: Local version string SSH-2.0-OpenSSH_9.6p1 Ubuntu-3ubuntu13.15 debug1: Remote protocol version 2.0, remote software version OpenSSH_7.3p1.RL debug1: compat_banner: match: OpenSSH_7.3p1.RL pat OpenSSH_7.0*,OpenSSH_7.1*,OpenSSH_7.2*,OpenSSH_7.3*,OpenSSH_7.5*,OpenSSH_7.6*,OpenSSH_7.7* compat 0x04000002 debug2: fd 3 setting O_NONBLOCK debug1: Authenticating to 192.168.42.251:22 as 'admin' debug1: load_hostkeys: fopen /var/lib/rancid/.ssh/known_hosts2: No such file or directory debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts: No such file or directory debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts2: No such file or directory debug1: SSH2_MSG_KEXINIT sent Received disconnect from 192.168.42.251 port 22:2: idle connection timeout expired
On the Cisco side it will output the following log (beware you first have to enable ssh logging on the device with 'ip ssh logging enable'
SSHD-I-SHUTDWN: Connection ID 14 - from 192.168.42.52 port 38654 closed. Reason: idle connection timeout expired
Regenerating the SSH keys on the device did not fix the problem.
As it was constantly erroring out at the SSH2_MSG_KEXINIT, I started to suspect a change in the SSH client that still tried the new host key algorithms first.
So I removed the + before ssh-rsa, and it started to work. So my final ~/.ssh/config is now:
Host * KexAlgorithms +diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,diffie-hellman-group14-sha1 HostKeyAlgorithms ssh-rsa
Note, that this is only for the user rancid, so all other ssh sessions by the normal users will still try to use the newer standards first.
