-
Notifications
You must be signed in to change notification settings - Fork 664
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
KEX diffie-hellman-group-exchange-sha1 isn't offered for Cisco #1235
Comments
Some SSH implementations are known to be buggy in different ways. In the case of Cisco's implementation, it has a problem with exchanging large diffie-hellman parameters, so we currently disable the group exchange in that case. It appears OpenSSH is simply capping the number of requested bits (to 4096) when connecting to a Cisco SSH server, so I suppose we could do the same instead of removing the algorithm outright if it proves to work reliably. Unfortunately I don't have any Cisco equipment to test against to verify that that will be the case. |
I can test changes across a lot of vendors not only Cisco in our network, will that help? |
I'm happy to test this as well on various Cisco implementations: IOS, IOS-XE, NX-OS. This changed has caused it to fail on our Cisco boxes, so happy to do any verification asap so we can get it included again! |
Please see pull request #1243 which is removing the The changes were tested on affected Cisco 1.25 box (and also on other 370 boxes with various SSH implementations in our lab). Thanks! |
Hello,
I have configured almost all KEX's algorithms, see the list
But when I'm trying to connect to Cisco then the
diffie-hellman-group-exchange-sha1
is never offered and I'm not able to connect there, seeBut it is offered for
SSH-2.0-ROSSSH
- Mikrotik deviceSo the question is why all configured algorithms are not always offered to all devices?
The last version
ssh2
(1.11.0) is usedThanks
The text was updated successfully, but these errors were encountered: