Switch configuration backups failing with error Invalid encoding: redundant leading 0s

[Ken_Applebaum]

Hi,

We backup the configuration of our switches nightly to our ExtremeCloud IQ Site Engine. This past week, we had five switches fail on different days, but not repeatedly, with the error:
"Invalid encoding: redundant leading 0s."

At this point, this is not a huge issue (136 other switches backed up successfully all week), but I haven't seen this before and want to make sure that there isn't an issue developing that will cause anything more than the occasional configuration backup failure.

I have not found any documentation regarding this in the Extreme support portal. Google results indicate that Java could cause this issue with other systems and applications.

We are running ExtremeCloud IQ - Site Engine 22.9.13.5.
Our Site Engine runs "Server JRE Version: 1.8.0_332." 

The switches config backups that failed are all Extreme X460G2-48p-10G4 & X460G2-24p-10G4 running firmware version 30.7.2.1-patch1-20.

Any insight to this issue would be appreciated. 

Thanks,
Ken

[Ken_Applebaum]

Thank you both for the information. I will be meeting with our security engineer regarding this issue. 

I will post back here once I determine if we are currently using DSA keys, or RSA keys. If we are using the former, we will make the recommended change. 

[OscarK]

Can you check if reconfiguring the ssh key on EXOS resolves the issue ?

See article https://extremeportal.force.com/ExtrArticleDetail?an=000105440, allthough for older EXOS versions the same solution might apply here.

[Robert_Haynes]

Please see "ExtremeCloud IQ - Site Engine - EXOS 16.x Archives Periodically Fail Using SSH DSS / DSA Keys" @ https://extremeportal.force.com/ExtrArticleDetail?an=000105440.

A search using "redundant leading 0s" via our support.extremenetworks.com portal would have yielded this result.

This issue was reproducible on any EXOS switch, regardless of version, where legacy DSA keys were used. A random key miscalculation offset with a leading 0 would result in the condition noted.

Replace the DSA keys with RSA keys.