Cant SSH2 to Extreme switches via Ubuntu

  • 0
  • 1
  • Problem
  • Updated 10 months ago
  • Solved
We recently enable SSH2 in our environment.  I am able to SSH to Cisco switches without any issue but can not to any Extreme switch.  I can login to them fine via teraterm/secureCRT but not via Ubuntu.

I have a Ubuntu 14.04 machine. Here is what I am getting:

ssh admin@extreme_switch.com
ssh_exchange_identification: read: Connection reset by peer

With -v for more info:

ssh -v admin@extreme_switch.com
OpenSSH_6.6.1, OpenSSL 1.0.1f 6 Jan 2014
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug1: Connecting to extreme_switch.com [10.10.0.99] port 22.
debug1: Connection established.
debug1: identity file /home/admin1/.ssh/id_rsa type -1
debug1: identity file /home/admin1/.ssh/id_rsa-cert type -1
debug1: identity file /home/admin1/.ssh/id_dsa type -1
debug1: identity file /home/admin1/.ssh/id_dsa-cert type -1
debug1: identity file /home/admin1/.ssh/id_ecdsa type -1
debug1: identity file /home/admin1/.ssh/id_ecdsa-cert type -1
debug1: identity file /home/admin1/.ssh/id_ed25519 type -1
debug1: identity file /home/admin1/.ssh/id_ed25519-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.6.1p1 Ubuntu-2ubuntu2.8
ssh_exchange_identification: read: Connection reset by peer

Any idea why I can not login to Extremes?  

Thanks
Zohaib
Photo of Marvell Kay

Marvell Kay

  • 280 Points 250 badge 2x thumb

Posted 11 months ago

  • 0
  • 1
Photo of David Coglianese

David Coglianese, Embassador

  • 7,388 Points 5k badge 2x thumb
What version of code are you running?
Is the ssh xmod installed if you are running 15.x or lower?
Photo of Marvell Kay

Marvell Kay

  • 280 Points 250 badge 2x thumb
We have different versions depending on model. Here are some and none are working:

8810/x8      -    bd8800-15.7.2.9-ssh.xmod v1572b9
x770           -    summitX-15.7.2.9-ssh.xmod v1572b9
x870           -    onie-22.2.1.5-patch1-4-debug.xmod 22.2.1.5-patch1-4
Photo of David Coglianese

David Coglianese, Embassador

  • 7,388 Points 5k badge 2x thumb
If you run {show man} is ssh enabled?

If not you can 
{enable ssh2}
Photo of Marvell Kay

Marvell Kay

  • 280 Points 250 badge 2x thumb
Here is a snippet of "sh man":

SSH access                       : Enabled (Key valid, tcp port 22 vr VR-Mgmt)
                                           : Secure-Mode    : Off
                                           : Access Profile : 25 Dynamic rules configured
SSH2 idle time                   : 60 minutes

SSH is enabled as I can SSH to all devices via SecureCRT
Photo of Andrew Imam

Andrew Imam, Alum

  • 1,026 Points 1k badge 2x thumb
Hi Zohaib,

For EXOS 15.7.2.9 you need to run the following commands to activate SSH on each switch:
- run update
- enable ssh2 vr all

For EXOS 22.2.1.5-P1-4 you need to run the following commands to activate SSH on each switch:
- enable ssh2 vr all

You can then run the "show management" command, check under the "SSH" heading that SSH is enabled and the key is valid.

Please let us know if you have any other questions.
Thank you.

Best regards,
Andrew
Photo of David Coglianese

David Coglianese, Embassador

  • 7,388 Points 5k badge 2x thumb
{Run update} should only be needed if the stack has not been booted since the code was loaded.

Also, to clarify if your switches are stacked, you only need to enable ssh on the master. 
Photo of Bernhard Gruenwald

Bernhard Gruenwald

  • 270 Points 250 badge 2x thumb
Hi,
after Ubuntu Update to 17.x I can't ssh to Extreme Switches (formerly Enterasys).
This helps for me:

ssh -o KexAlgorithms=+diffie-hellman-group1-sha1 admin@<ip-of-switch>

or this options to an X450:

ssh -o HostKeyAlgorithms=+ssh-dss admin@<ip-of-switch>

Regards,
Bernhard
Photo of Frank

Frank

  • 3,836 Points 3k badge 2x thumb
Instead of typing the -o... on the command line every time (or more often, depending on your skill to avoid typos), you can also put it into your ~/.ssh/config file. See https://www.openssh.com/legacy.html
Lazy fat-fingered me would probably do that ;)
Photo of Marvell Kay

Marvell Kay

  • 280 Points 250 badge 2x thumb
I am getting this:

Unsupported KEX algorithm "+diffie-hellman-group1-sha1"
command-line line 0: Bad SSH2 KexAlgorithms '+diffie-hellman-group1-sha1'.
Photo of Grosjean, Stephane

Grosjean, Stephane, Employee

  • 13,676 Points 10k badge 2x thumb
Are you using openssh from ubuntu?

Your issue (with 15.7 EXOS version) is definitely related to the upgrade of openssh, and the legacy keys being disabled by default. The link from Frank is the solution.

For 22.x code, this is not necessary. I see you have a debug EXOS release. Why?
Photo of Bernhard Gruenwald

Bernhard Gruenwald

  • 270 Points 250 badge 2x thumb
ssh -Q kex
Photo of Marvell Kay

Marvell Kay

  • 280 Points 250 badge 2x thumb
Yes, I am using openssh on Ubuntu.

I did try Bernhard Gruenwald and Frank's solution but it did not work.  I will try again and capture error message.  I am not sure about that debug file, I will check other 870s
(Edited)
Photo of Bernhard Gruenwald

Bernhard Gruenwald

  • 270 Points 250 badge 2x thumb
Yes, I did this already. Like this:

vi .ssh/config

Host x450
   HostName <ip-of-switch>
   HostKeyAlgorithms=+ssh-dss
   User admin


Then "ssh x450"
Photo of Drew C.

Drew C., Community Manager

  • 40,858 Points 20k badge 2x thumb
For "older" EXOS switches, I added an alias to my bash_profile (OS X) to automatically add the older cypher. That way the extra algorithms are added by using: oldssh (switch_address)
Here's what I added:

$ grep oldssh .bash_profile
alias oldssh='ssh -o KexAlgorithms=+diffie-hellman-group1-sha1 -o HostKeyAlgorithms=+ssh-dss'
(Edited)
Photo of Brandon Clay

Brandon Clay, Escalation Support Engineer

  • 13,608 Points 10k badge 2x thumb
I was just about to suggest the same thing. I like this better than modifying the ~/.ssh/config file, since it will error out at first (with just ssh), and let you choose to downgrade to older, less secure algorithms.
Photo of Marvell Kay

Marvell Kay

  • 280 Points 250 badge 2x thumb
Thanks all for help.  I tried a different Ubuntu machine on a different subnet and i worked.  It seems to be blocked somewhere.  
Photo of Drew C.

Drew C., Community Manager

  • 40,724 Points 20k badge 2x thumb
Glad you got it [mostly] figured out. Thanks for letting us know!
Photo of Brandon Clay

Brandon Clay, Escalation Support Engineer

  • 13,606 Points 10k badge 2x thumb
Does the switch happen to have an SSH access profile on it? It sounds like it may be getting blocked by that.

If it is, you should be able to see a log message that the SSH attempt was denied to due an access profile.