topic Re: SSH Key based authentication on 5520 32.6.1.5 (Latest Feature Release) in ExtremeSwitching (EXOS/Switch Engine)

SSH Key based authentication on 5520 32.6.1.5 (Latest Feature Release)

danno765 — Wed, 06 Mar 2024 11:09:02 GMT

I have a 5520 which I am trying to log into via SSH key based authentication. I followed the user manuals instructions and configured it correctly for version 31.2.1.1, however when I upgraded the box from version 31.2.1.1 to version 32.6.1.5, I could no longer authenticate without a password.

I downgraded again to make sure it worked and it did, upgraded again and it doesn't. Is this a known issue by anyone? is there any way I can fix this? It does not show up as a 'known issue' in the release notes of the patch located here:

https://documentation.extremenetworks.com/release_notes/switchengine/32.6.1/GUID-E6056C3D-6E17-4C66-823C-7A71FC1BFEB9.shtml

For reference, I have transferred my keys onto a box that was already running 32.6.1.5 following the same method as is described in that versions manual, as well as upgrading to 32.6.1.5 from a lower version that already had the authentication working.

Any input is appreciated, thanks in advance.

EDIT:

I have since used the command below to inspect the size of my key and it shows as 3072 bits. Additionally, my colleague tried multiple sizes including the default rsa size (non specified when generating) and one time attempted to use a much larger key which presented an error that said "key too large".

ssh-keygen -l -f ~/.ssh/id_rsa.pub

I have double checked the exact filename of the OS I have installed and it is summit_arm-32.6.1.5-patch1-2.xos and for reference, this is the version it is not working on during my, and my colleagues testing.

Re: SSH Key based authentication on 5520 32.6.1.5 (Latest Feature Release)

Stefan_K_ — Mon, 04 Mar 2024 15:53:14 GMT

Hi @danno765

Is the key 1024 or 2048 bits?

Best regards
Stefan

Re: SSH Key based authentication on 5520 32.6.1.5 (Latest Feature Release)

danno765 — Mon, 04 Mar 2024 16:07:11 GMT

I can't remember for certain, and am not 100% sure how to check, however when I grep "keygen" in my command history on the machine I am SSH-ing from, I can see that I generated a 4096 bit key, so I believe it is 4096 bits.

Re: SSH Key based authentication on 5520 32.6.1.5 (Latest Feature Release)

danno765 — Tue, 05 Mar 2024 09:16:25 GMT

ssh-keygen -l -f ~/.ssh/id_rsa.pub

Re: SSH Key based authentication on 5520 32.6.1.5 (Latest Feature Release)

Manfred_Huels — Tue, 05 Mar 2024 14:20:54 GMT

with ExtremeXOS version 32.6.1.5 32.6.1.5-patch1-2 it should work again.

greets
Manfred

Re: SSH Key based authentication on 5520 32.6.1.5 (Latest Feature Release)

Stefan_K_ — Tue, 05 Mar 2024 15:44:07 GMT

How do you know? It's not listed in the resolved issues in the release notes.

Re: SSH Key based authentication on 5520 32.6.1.5 (Latest Feature Release)

danno765 — Wed, 06 Mar 2024 10:15:58 GMT

Thank you for your response, this is my bad, however. I have double checked the exact filename of the OS I have installed and it is summit_arm-32.6.1.5-patch1-2.xos and for reference, this is the version it is not working on during my, and my colleagues testing.

Re: SSH Key based authentication on 5520 32.6.1.5 (Latest Feature Release)

Manfred_Huels — Wed, 06 Mar 2024 16:14:14 GMT

unfortunately I don't really know. We have had the same problem, submitted an error case to the manufacturer, and awaiting now any reaction. When I wanted to test it again, it works suddenly. I thought because of the os-patchlevel, anyone of my colleagues had installed the patch in the last days. But they say they have done nothing. My ssh-client has never changed since years.

Re: SSH Key based authentication on 5520 32.6.1.5 (Latest Feature Release)

Manfred_Huels — Wed, 06 Mar 2024 16:18:09 GMT

perhaps it is a timing problem. If the radius server is present and answers fast enough, the switch wants to authorize via radius and ignores the key.

Re: SSH Key based authentication on 5520 32.6.1.5 (Latest Feature Release)

Stefan_K_ — Tue, 19 Mar 2024 14:24:04 GMT

we have a GTAC article now: https://extreme-networks.my.site.com/ExtrArticleDetail?an=000117492

It will be fixed in 32.7.

Re: SSH Key based authentication on 5520 32.6.1.5 (Latest Feature Release)

Kaiden22 — Tue, 23 Apr 2024 08:44:07 GMT

I also encountered the same problem.

steppermotor