我遇到的问题是，将服务器升级到最新版本后，我的服务器无法 ssh 到 cisco 设备。
我做了一个ssh -vvv,我不确定的两个部分。详细信息如下：
我想知道密码 ctos 和密码 stoc 的含义
密码ctos：[email protected],aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected]
密码股票：[email protected],aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected]
同样在日志的末尾，得到信息：无法与 10.44.39.202 端口 22 协商：找不到匹配的密钥交换方法。他们的报价：diffie-hellman-group1-sha1
可以添加diffie-hellman-group1-sha1到主机密钥算法吗？
以下是调试日志：
-bash-4.0# ssh -vvv 10.44.39.202 OpenSSH_7.7p1, OpenSSL 1.0.2j-fips 26 Sep 2016
debug1: Reading configuration data /usr/etc/ssh_config
debug2: resolve_canonicalize: hostname 10.44.39.202 is address
debug2: ssh_connect_direct: needpriv 0
debug1: Connecting to 10.44.39.202 [10.44.39.202] port 22.
debug1: Connection established.
debug1: permanently_set_uid: 0/0
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_rsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_rsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_dsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_dsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_ecdsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_ecdsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_ed25519 type -1
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_ed25519-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_xmss type -1
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_xmss-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_7.7
debug1: Remote protocol version 2.0, remote software version Cisco-1.25
debug1: match: Cisco-1.25 pat Cisco-1.* compat 0x60000000
debug2: fd 3 setting O_NONBLOCK
debug1: Authenticating to 10.44.39.202:22 as 'root'
debug3: send packet: type 20
debug1: SSH2_MSG_KEXINIT sent
debug3: receive packet: type 20
debug1: SSH2_MSG_KEXINIT received
debug2: local client KEXINIT proposal
debug2: KEX algorithms: curve25519-sha256,[email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c
debug2: host key algorithms: [email protected],[email protected],[email protected],[email protected],[email protected],ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa
debug2: ciphers ctos: [email protected],aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected]
debug2: ciphers stoc: [email protected],aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected]
debug2: MACs ctos: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: MACs stoc: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: compression ctos: none,[email protected],zlib
debug2: compression stoc: none,[email protected],zlib
debug2: languages ctos:
debug2: languages stoc:
debug2: first_kex_follows 0
debug2: reserved 0
debug2: peer server KEXINIT proposal
debug2: KEX algorithms: diffie-hellman-group1-sha1
debug2: host key algorithms: ssh-rsa
debug2: ciphers ctos: aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc
debug2: ciphers stoc: aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc
debug2: MACs ctos: hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96
debug2: MACs stoc: hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96
debug2: compression ctos: none
debug2: compression stoc: none
debug2: languages ctos:
debug2: languages stoc:
debug2: first_kex_follows 0
debug2: reserved 0
debug1: kex: algorithm: (no match)
Unable to negotiate with 10.44.39.202 port 22: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1
答案1
默认情况下，升级后的 OpenSSH 不再包含 diffie-hellman-group1-sha1 作为密钥交换算法，但这是 Cisco 设备提供的唯一密钥交换算法。
最快的解决方法是告诉您的 SSH 客户端可以使用 diffie-hellman-group1-sha1 与该设备进行通信。在 ~/.ssh/config 中添加一个节，如下所示：
Host 10.44.39.202
KexAlgorithms +diffie-hellman-group1-sha1
参考：
如果客户端和服务器无法就一组相互参数达成一致，则连接将失败。 OpenSSH（7.0 及更高版本）将产生如下错误消息：
Unable to negotiate with legacyhost: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1