[rancid] ssh problems

[Wayne Eisenberg]

Hi all,

I was setting up a new ASA 5545 to be part of our happy family, and it would not let rancid/ssh login to it, although putty has no problem. The output I get is:

[***@hosted]$ ssh -vvv -c aes256-cbc -x -l <***> <x.x.x.x>
OpenSSH_5.1p1, OpenSSL 0.9.8i 15 Sep 2008
debug1: Reading configuration data /etc/ssh/ssh_config
debug2: ssh_connect: needpriv 0
debug1: Connecting to [x.x.x.x] port 22.
debug1: Connection established.
debug1: identity file /home/rancid/.ssh/identity type -1
debug3: Not a RSA1 key file /home/rancid/.ssh/id_rsa.
debug2: key_type_from_name: unknown key type '-----BEGIN'
debug3: key_read: missing keytype
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug2: key_type_from_name: unknown key type '-----END'
debug3: key_read: missing keytype
debug1: identity file /home/rancid/.ssh/id_rsa type 1
debug1: identity file /home/rancid/.ssh/id_dsa type -1
ssh_exchange_identification: Connection closed by remote host

The relevant part of the firewall config:
ssh scopy enable
ssh y.y.y.y z.z.z.z outside
ssh 0.0.0.0 0.0.0.0 inside
ssh timeout 30
ssh key-exchange group dh-group1-sha1

I suspect the key-exchange group line is the issue, but dang if I can figure out how to resolve it. I do not have any problems with using ssh on any other device at all. So yes, I have an id_rsa file that seems to be just fine since I connect to all the other devices.

The /etc/ssh/ssh_config file is only comments, no commands in there. If I try to add a line for KexAlgorithms, ssh gives me an error, 'bad configuration option'.

ssh -V => OpenSSH_5.1p1, OpenSSL 0.9.8i 15 Sep 2008
ssh -Q is not a valid option


Any ideas?

Thanks,
Wayne


________________________________

The information in this Internet e-mail (and any attachments) is confidential, may be legally privileged and is intended solely for the Addressee(s) named above. If you are not the intended recipient, or the employee or agent responsible for delivering it to the intended recipient, then any dissemination or copying of this e-mail (and any attachments) is prohibited and may be unlawful. If you received this e-mail in error, please immediately notify us by e-mail or telephone, then delete the message. Thank you.

[Scott Granados]

You didn’t by chance generate this key your using on a windows device and then SCP it to your asa did you? All the white space errors are jumping out at me making me think there’s a problem in the CR / LF handling but that’s an absolute pure guess so please add as many grains of salt as you feel is warranted.:)

Post by Wayne Eisenberg
Hi all,
OpenSSH_5.1p1, OpenSSL 0.9.8i 15 Sep 2008
debug1: Reading configuration data /etc/ssh/ssh_config
debug2: ssh_connect: needpriv 0
debug1: Connecting to [x.x.x.x] port 22.
debug1: Connection established.
debug1: identity file /home/rancid/.ssh/identity type -1
debug3: Not a RSA1 key file /home/rancid/.ssh/id_rsa.
debug2: key_type_from_name: unknown key type '-----BEGIN'
debug3: key_read: missing keytype
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug2: key_type_from_name: unknown key type '-----END'
debug3: key_read: missing keytype
debug1: identity file /home/rancid/.ssh/id_rsa type 1
debug1: identity file /home/rancid/.ssh/id_dsa type -1
ssh_exchange_identification: Connection closed by remote host
ssh scopy enable
ssh y.y.y.y z.z.z.z outside
ssh 0.0.0.0 0.0.0.0 inside
ssh timeout 30
ssh key-exchange group dh-group1-sha1
I suspect the key-exchange group line is the issue, but dang if I can figure out how to resolve it. I do not have any problems with using ssh on any other device at all. So yes, I have an id_rsa file that seems to be just fine since I connect to all the other devices.
The /etc/ssh/ssh_config file is only comments, no commands in there. If I try to add a line for KexAlgorithms, ssh gives me an error, ‘bad configuration option’.
ssh –V => OpenSSH_5.1p1, OpenSSL 0.9.8i 15 Sep 2008
ssh –Q is not a valid option
Any ideas?
Thanks,
Wayne
The information in this Internet e-mail (and any attachments) is confidential, may be legally privileged and is intended solely for the Addressee(s) named above. If you are not the intended recipient, or the employee or agent responsible for delivering it to the intended recipient, then any dissemination or copying of this e-mail (and any attachments) is prohibited and may be unlawful. If you received this e-mail in error, please immediately notify us by e-mail or telephone, then delete the message. Thank you.
_______________________________________________
Rancid-discuss mailing list
http://www.shrubbery.net/mailman/listinfo/rancid-discuss <http://www.shrubbery.net/mailman/listinfo/rancid-discuss>

[Wayne Eisenberg]

The ASA? The key there existed before my involvement, so I have no idea where it was generated. But I thought this was a problem with the local key of the rancid host, which was generated on it.

You didn’t by chance generate this key your using on a windows device and then SCP it to your asa did you? All the white space errors are jumping out at me making me think there’s a problem in the CR / LF handling but that’s an absolute pure guess so please add as many grains of salt as you feel is warranted.:)


On May 10, 2017, at 5:44 PM, Wayne Eisenberg <***@CarolinasIT.com<mailto:***@CarolinasIT.com>> wrote:

Hi all,

I was setting up a new ASA 5545 to be part of our happy family, and it would not let rancid/ssh login to it, although putty has no problem. The output I get is:

[***@hosted]$ ssh -vvv -c aes256-cbc -x -l <***> <x.x.x.x>
OpenSSH_5.1p1, OpenSSL 0.9.8i 15 Sep 2008
debug1: Reading configuration data /etc/ssh/ssh_config
debug2: ssh_connect: needpriv 0
debug1: Connecting to [x.x.x.x] port 22.
debug1: Connection established.
debug1: identity file /home/rancid/.ssh/identity type -1
debug3: Not a RSA1 key file /home/rancid/.ssh/id_rsa.
debug2: key_type_from_name: unknown key type '-----BEGIN'
debug3: key_read: missing keytype
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug2: key_type_from_name: unknown key type '-----END'
debug3: key_read: missing keytype
debug1: identity file /home/rancid/.ssh/id_rsa type 1
debug1: identity file /home/rancid/.ssh/id_dsa type -1
ssh_exchange_identification: Connection closed by remote host

The relevant part of the firewall config:
ssh scopy enable
ssh y.y.y.y z.z.z.z outside
ssh 0.0.0.0 0.0.0.0 inside
ssh timeout 30
ssh key-exchange group dh-group1-sha1

I suspect the key-exchange group line is the issue, but dang if I can figure out how to resolve it. I do not have any problems with using ssh on any other device at all. So yes, I have an id_rsa file that seems to be just fine since I connect to all the other devices.

The /etc/ssh/ssh_config file is only comments, no commands in there. If I try to add a line for KexAlgorithms, ssh gives me an error, ‘bad configuration option’.

ssh –V => OpenSSH_5.1p1, OpenSSL 0.9.8i 15 Sep 2008
ssh –Q is not a valid option


Any ideas?

Thanks,
Wayne



________________________________

The information in this Internet e-mail (and any attachments) is confidential, may be legally privileged and is intended solely for the Addressee(s) named above. If you are not the intended recipient, or the employee or agent responsible for delivering it to the intended recipient, then any dissemination or copying of this e-mail (and any attachments) is prohibited and may be unlawful. If you received this e-mail in error, please immediately notify us by e-mail or telephone, then delete the message. Thank you.

[heasley]

Post by Wayne Eisenberg
The ASA? The key there existed before my involvement, so I have no idea where it was generated. But I thought this was a problem with the local key of the rancid host, which was generated on it.

well, it seems to be in the wrong format; given the error, probably PKCS.

Post by Wayne Eisenberg
debug3: Not a RSA1 key file /home/rancid/.ssh/id_rsa.
debug2: key_type_from_name: unknown key type '-----BEGIN'

move it aside, and

% ssh-keygen -t rsa

[Wayne Eisenberg]

I was just informed that there is some kind of network device sitting in front of the firewall, intercepting traffic. I will get that resolved first and then try rancid again, so this troubleshooting is temporarily on hold. Thanks for the suggestions, though.


-----Original Message-----
From: heasley [mailto:***@shrubbery.net]
Sent: Thursday, May 11, 2017 10:44 AM
To: Wayne Eisenberg
Cc: 'Scott Granados'; 'rancid-***@shrubbery.net'
Subject: Re: [rancid] ssh problems

Post by Wayne Eisenberg
The ASA? The key there existed before my involvement, so I have no idea where it was generated. But I thought this was a problem with the local key of the rancid host, which was generated on it.

well, it seems to be in the wrong format; given the error, probably PKCS.

Post by Wayne Eisenberg
debug3: Not a RSA1 key file /home/rancid/.ssh/id_rsa.
debug2: key_type_from_name: unknown key type '-----BEGIN'

move it aside, and

% ssh-keygen -t rsa

________________________________

The information in this Internet e-mail (and any attachments) is confidential, may be legally privileged and is intended solely for the Addressee(s) named above. If you are not the intended recipient, or the employee or agent responsible for delivering it to the intended recipient, then any dissemination or copying of this e-mail (and any attachments) is prohibited and may be unlawful. If you received this e-mail in error, please immediately notify us by e-mail or telephone, then delete the message. Thank you.

['heasley']

Post by Wayne Eisenberg
I was just informed that there is some kind of network device sitting in front of the firewall, intercepting traffic. I will get that resolved first and then try rancid again, so this troubleshooting is temporarily on hold. Thanks for the suggestions, though.

that is not the problem. that error is clearly from the client program,
ie: local.

Post by Wayne Eisenberg
-----Original Message-----
Sent: Thursday, May 11, 2017 10:44 AM
To: Wayne Eisenberg
Subject: Re: [rancid] ssh problems

Post by Wayne Eisenberg
The ASA? The key there existed before my involvement, so I have no idea where it was generated. But I thought this was a problem with the local key of the rancid host, which was generated on it.

well, it seems to be in the wrong format; given the error, probably PKCS.

Post by Wayne Eisenberg
debug3: Not a RSA1 key file /home/rancid/.ssh/id_rsa.
debug2: key_type_from_name: unknown key type '-----BEGIN'

move it aside, and
% ssh-keygen -t rsa
________________________________
The information in this Internet e-mail (and any attachments) is confidential, may be legally privileged and is intended solely for the Addressee(s) named above. If you are not the intended recipient, or the employee or agent responsible for delivering it to the intended recipient, then any dissemination or copying of this e-mail (and any attachments) is prohibited and may be unlawful. If you received this e-mail in error, please immediately notify us by e-mail or telephone, then delete the message. Thank you.

[Wayne Eisenberg]

Well, I did as you suggested and nothing changed. There are no problems contacting dozens of other devices with the exact same key. I'll let you know how it goes once that other device is updated.

-----Original Message-----
From: 'heasley' [mailto:***@shrubbery.net]
Sent: Friday, May 12, 2017 11:43 AM
To: Wayne Eisenberg
Cc: 'heasley'; 'Scott Granados'; 'rancid-***@shrubbery.net'
Subject: Re: [rancid] ssh problems

Post by Wayne Eisenberg
I was just informed that there is some kind of network device sitting in front of the firewall, intercepting traffic. I will get that resolved first and then try rancid again, so this troubleshooting is temporarily on hold. Thanks for the suggestions, though.

that is not the problem. that error is clearly from the client program,
ie: local.

Post by Wayne Eisenberg
-----Original Message-----
Sent: Thursday, May 11, 2017 10:44 AM
To: Wayne Eisenberg
Subject: Re: [rancid] ssh problems

Post by Wayne Eisenberg
The ASA? The key there existed before my involvement, so I have no idea where it was generated. But I thought this was a problem with the local key of the rancid host, which was generated on it.

well, it seems to be in the wrong format; given the error, probably PKCS.

Post by Wayne Eisenberg
debug3: Not a RSA1 key file /home/rancid/.ssh/id_rsa.
debug2: key_type_from_name: unknown key type '-----BEGIN'

move it aside, and
% ssh-keygen -t rsa
________________________________
The information in this Internet e-mail (and any attachments) is confidential, may be legally privileged and is intended solely for the Addressee(s) named above. If you are not the intended recipient, or the employee or agent responsible for delivering it to the intended recipient, then any dissemination or copying of this e-mail (and any attachments) is prohibited and may be unlawful. If you received this e-mail in error, please immediately notify us by e-mail or telephone, then delete the message. Thank you.

['heasley']

Post by Wayne Eisenberg
Well, I did as you suggested and nothing changed. There are no problems contacting dozens of other devices with the exact same key. I'll let you know how it goes once that other device is updated.

it should no longer produce the same error though; correct?

Post by Wayne Eisenberg
-----Original Message-----
Sent: Friday, May 12, 2017 11:43 AM
To: Wayne Eisenberg
Subject: Re: [rancid] ssh problems

Post by Wayne Eisenberg
I was just informed that there is some kind of network device sitting in front of the firewall, intercepting traffic. I will get that resolved first and then try rancid again, so this troubleshooting is temporarily on hold. Thanks for the suggestions, though.

that is not the problem. that error is clearly from the client program,
ie: local.

Post by Wayne Eisenberg
-----Original Message-----
Sent: Thursday, May 11, 2017 10:44 AM
To: Wayne Eisenberg
Subject: Re: [rancid] ssh problems

Post by Wayne Eisenberg
The ASA? The key there existed before my involvement, so I have no idea where it was generated. But I thought this was a problem with the local key of the rancid host, which was generated on it.

well, it seems to be in the wrong format; given the error, probably PKCS.

Post by Wayne Eisenberg
debug3: Not a RSA1 key file /home/rancid/.ssh/id_rsa.
debug2: key_type_from_name: unknown key type '-----BEGIN'

move it aside, and
% ssh-keygen -t rsa
________________________________
The information in this Internet e-mail (and any attachments) is confidential, may be legally privileged and is intended solely for the Addressee(s) named above. If you are not the intended recipient, or the employee or agent responsible for delivering it to the intended recipient, then any dissemination or copying of this e-mail (and any attachments) is prohibited and may be unlawful. If you received this e-mail in error, please immediately notify us by e-mail or telephone, then delete the message. Thank you.

[Wayne Eisenberg]

No change. If we can get that filtering device dealt with, I'll update you.

-----Original Message-----
From: 'heasley' [mailto:***@shrubbery.net]
Sent: Monday, May 15, 2017 6:14 PM
To: Wayne Eisenberg
Cc: 'heasley'; 'Scott Granados'; 'rancid-***@shrubbery.net'
Subject: Re: [rancid] ssh problems

Post by Wayne Eisenberg
Well, I did as you suggested and nothing changed. There are no problems contacting dozens of other devices with the exact same key. I'll let you know how it goes once that other device is updated.

it should no longer produce the same error though; correct?


________________________________

The information in this Internet e-mail (and any attachments) is confidential, may be legally privileged and is intended solely for the Addressee(s) named above. If you are not the intended recipient, or the employee or agent responsible for delivering it to the intended recipient, then any dissemination or copying of this e-mail (and any attachments) is prohibited and may be unlawful. If you received this e-mail in error, please immediately notify us by e-mail or telephone, then delete the message. Thank you.

[Doug Hughes]

I had some problems with newer ASAs too. Try this in your .cloginrc

add cyphertype <device_here> aes256-cbc

Post by Wayne Eisenberg
Hi all,
I was setting up a new ASA 5545 to be part of our happy family, and it
would not let rancid/ssh login to it, although putty has no problem.
OpenSSH_5.1p1, OpenSSL 0.9.8i 15 Sep 2008
debug1: Reading configuration data /etc/ssh/ssh_config
debug2: ssh_connect: needpriv 0
debug1: Connecting to [x.x.x.x] port 22.
debug1: Connection established.
debug1: identity file /home/rancid/.ssh/identity type -1
debug3: Not a RSA1 key file /home/rancid/.ssh/id_rsa.
debug2: key_type_from_name: unknown key type '-----BEGIN'
debug3: key_read: missing keytype
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug2: key_type_from_name: unknown key type '-----END'
debug3: key_read: missing keytype
debug1: identity file /home/rancid/.ssh/id_rsa type 1
debug1: identity file /home/rancid/.ssh/id_dsa type -1
ssh_exchange_identification: Connection closed by remote host
ssh scopy enable
ssh y.y.y.y z.z.z.z outside
ssh 0.0.0.0 0.0.0.0 inside
ssh timeout 30
ssh key-exchange group dh-group1-sha1
I suspect the key-exchange group line is the issue, but dang if I can
figure out how to resolve it. I do not have any problems with using
ssh on any other device at all. So yes, I have an id_rsa file that
seems to be just fine since I connect to all the other devices.
The /etc/ssh/ssh_config file is only comments, no commands in there.
If I try to add a line for KexAlgorithms, ssh gives me an error, ‘bad
configuration option’.
ssh –V => OpenSSH_5.1p1, OpenSSL 0.9.8i 15 Sep 2008
ssh –Q is not a valid option
Any ideas?
Thanks,
Wayne
------------------------------------------------------------------------
The information in this Internet e-mail (and any attachments) is
confidential, may be legally privileged and is intended solely for the
Addressee(s) named above. If you are not the intended recipient, or
the employee or agent responsible for delivering it to the intended
recipient, then any dissemination or copying of this e-mail (and any
attachments) is prohibited and may be unlawful. If you received this
e-mail in error, please immediately notify us by e-mail or telephone,
then delete the message. Thank you.
_______________________________________________
Rancid-discuss mailing list
http://www.shrubbery.net/mailman/listinfo/rancid-discuss