problem with ~/.ssh/config ?

[Lee <ler762 at gmail dot com>]

OpenSSH 7.0 defaults to no support for diffie-hellman-group1-sha1 key
exchange which is a problem with certain devices:

$ ssh  10.10.3.5
Unable to negotiate with 10.10.3.5: no matching key exchange method
found. Their offer: diffie-hellman-group1-sha1

http://www.openssh.com/legacy.html  has two work-arounds:
1. add "-oKexAlgorithms=+diffie-hellman-group1-sha1" to the ssh
command -- which works for me
2. add "Host * KexAlgorithms +diffie-hellman-group1-sha1" to
~/.ssh/config -- which does not work for me

What's the trick for getting the KexAlgorithms param in ~/.ssh/config to work?

$ cat ~/.ssh/config
# ssh common params
# Protocol 2,1
#   ??? still need version 1 compatability ???


# IOS devices running "Remote protocol version 1.99, remote software
version Cisco-1.25"
# only do diffie-hellman-group1-sha1 for key exchange & OpenSSH 7.0
has it disabled by default.
# re-enable & add to the end of the list:
Host  *  KexAlgorithms +diffie-hellman-group1-sha1

ServerAliveInterval  40
#  Sets a timeout interval in seconds after which if no data has
#  been received from the server, ssh(1) will send a message through
#  the encrypted channel to request a response from the server.

ServerAliveCountMax  6
#  Sets the number of server alive messages which may be
#  sent without ssh(1) receiving any messages back from the server.
#  If this threshold is reached while server alive messages are
#  being sent, ssh will disconnect from the server, terminating the
#  session.

TCPKeepAlive yes
#   Specifies whether the system should send TCP keepalive messages
#   to the other side.  If they are sent, death of the connection or
#   crash of one of the machines will be properly noticed.  However,
#   this means that connections will die if the route is down temporarily,
#   and some people find it annoying.


~

add "-o" on command line: works
$ ssh -oKexAlgorithms=+diffie-hellman-group1-sha1 -G 10.10.3.5 | grep -i kex
kexalgorithms curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1

"host * KexAlgorithms" in .ssh/config does not work:
$ ssh  -G 10.10.3.5 | grep -i kex
kexalgorithms curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1


if it helps any, ssh with the -v option:

$ ssh -v 10.10.3.5
OpenSSH_7.0p1, OpenSSL 1.0.2d 9 Jul 2015
debug1: Reading configuration data /home/Lee/.ssh/config
debug1: /home/Lee/.ssh/config line 9: Applying options for *
debug1: Connecting to 10.10.3.5 [10.10.3.5] port 22.
debug1: Connection established.
debug1: key_load_public: No such file or directory
debug1: identity file /home/Lee/.ssh/id_rsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/Lee/.ssh/id_rsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/Lee/.ssh/id_dsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/Lee/.ssh/id_dsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/Lee/.ssh/id_ecdsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/Lee/.ssh/id_ecdsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/Lee/.ssh/id_ed25519 type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/Lee/.ssh/id_ed25519-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_7.0
debug1: Remote protocol version 2.0, remote software version Cisco-1.25
debug1: match: Cisco-1.25 pat Cisco-1.* compat 0x60000000
debug1: Authenticating to 10.10.3.5:22 as 'Lee'
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-cbc hmac-sha1 none
debug1: kex: client->server aes128-cbc hmac-sha1 none
Unable to negotiate with 10.10.3.5: no matching key exchange method
found. Their offer: diffie-hellman-group1-sha1


TIA,
Lee

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple