topic ssl downgrade by default? in ExtremeSwitching (EXOS/Switch Engine)

ssl downgrade by default?

shampoo — Tue, 21 Jun 2016 03:11:00 GMT

Hey guys,

When we ssh into a default install of exos, we're receving what appears to be a downgrade to a weak cipher/key exchange protocol:

Unable to negotiate with 10.xx.xx.xx port 22: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1

Do you know when this might be fixed?

RE: ssl downgrade by default?

BrandonC — Tue, 21 Jun 2016 03:16:00 GMT

What version of EXOS are you seeing this on? Also, what SSH client are you using?

-Brandon

RE: ssl downgrade by default?

shampoo — Tue, 21 Jun 2016 05:40:00 GMT

Hey Brandon,

We're seeing this on v15.7.14 and are just using the terminal ssh client on Fedora 23

Thanks

RE: ssl downgrade by default?

Jeremy_Gibbs — Tue, 21 Jun 2016 08:58:00 GMT

Ahh yes.. This is what I do

ssh -oHostKeyAlgorithms=+ssh-dss -l USERNAME IPADDRESS

Should be able to add this to your ~/.ssh/config

HostkeyAlgorithms +ssh-dss

That way you don't have to type in the -oHostKeyAlg...