<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<p>I had some problems with newer ASAs too. Try this in your
.cloginrc</p>
<p>add cyphertype <device_here> aes256-cbc<br>
</p>
<br>
<div class="moz-cite-prefix">On 5/10/2017 5:44 PM, Wayne Eisenberg
wrote:<br>
</div>
<blockquote
cite="mid:E9195982D718B243AB9E1BB6F45058E07F421AF8@CITEX01.sytec1.com"
type="cite">
<meta http-equiv="Content-Type" content="text/html;
charset=windows-1252">
<style>
<!--
@font-face
{font-family:"Cambria Math"}
@font-face
{font-family:Calibri}
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif"}
a:link, span.MsoHyperlink
{color:#0563C1;
text-decoration:underline}
a:visited, span.MsoHyperlinkFollowed
{color:#954F72;
text-decoration:underline}
span.EmailStyle17
{font-family:"Calibri","sans-serif";
color:windowtext}
.MsoChpDefault
{font-family:"Calibri","sans-serif"}
@page WordSection1
{margin:1.0in 1.0in 1.0in 1.0in}
div.WordSection1
{}
-->
</style>
<div class="WordSection1">
<p class="MsoNormal">Hi all,</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">I was setting up a new ASA 5545 to be part
of our happy family, and it would not let rancid/ssh login to
it, although putty has no problem. The output I get is:</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">[rancid@hosted]$ ssh -vvv -c aes256-cbc -x
-l <***> <x.x.x.x></p>
<p class="MsoNormal">OpenSSH_5.1p1, OpenSSL 0.9.8i 15 Sep 2008</p>
<p class="MsoNormal">debug1: Reading configuration data
/etc/ssh/ssh_config</p>
<p class="MsoNormal">debug2: ssh_connect: needpriv 0</p>
<p class="MsoNormal">debug1: Connecting to [x.x.x.x] port 22.</p>
<p class="MsoNormal">debug1: Connection established.</p>
<p class="MsoNormal">debug1: identity file
/home/rancid/.ssh/identity type -1</p>
<p class="MsoNormal">debug3: Not a RSA1 key file
/home/rancid/.ssh/id_rsa.</p>
<p class="MsoNormal">debug2: key_type_from_name: unknown key
type '-----BEGIN'</p>
<p class="MsoNormal">debug3: key_read: missing keytype</p>
<p class="MsoNormal">debug3: key_read: missing whitespace</p>
<p class="MsoNormal">debug3: key_read: missing whitespace</p>
<p class="MsoNormal">debug3: key_read: missing whitespace</p>
<p class="MsoNormal">debug3: key_read: missing whitespace</p>
<p class="MsoNormal">debug3: key_read: missing whitespace</p>
<p class="MsoNormal">debug3: key_read: missing whitespace</p>
<p class="MsoNormal">debug3: key_read: missing whitespace</p>
<p class="MsoNormal">debug3: key_read: missing whitespace</p>
<p class="MsoNormal">debug3: key_read: missing whitespace</p>
<p class="MsoNormal">debug3: key_read: missing whitespace</p>
<p class="MsoNormal">debug3: key_read: missing whitespace</p>
<p class="MsoNormal">debug3: key_read: missing whitespace</p>
<p class="MsoNormal">debug3: key_read: missing whitespace</p>
<p class="MsoNormal">debug3: key_read: missing whitespace</p>
<p class="MsoNormal">debug3: key_read: missing whitespace</p>
<p class="MsoNormal">debug3: key_read: missing whitespace</p>
<p class="MsoNormal">debug3: key_read: missing whitespace</p>
<p class="MsoNormal">debug3: key_read: missing whitespace</p>
<p class="MsoNormal">debug3: key_read: missing whitespace</p>
<p class="MsoNormal">debug3: key_read: missing whitespace</p>
<p class="MsoNormal">debug3: key_read: missing whitespace</p>
<p class="MsoNormal">debug3: key_read: missing whitespace</p>
<p class="MsoNormal">debug3: key_read: missing whitespace</p>
<p class="MsoNormal">debug3: key_read: missing whitespace</p>
<p class="MsoNormal">debug3: key_read: missing whitespace</p>
<p class="MsoNormal">debug2: key_type_from_name: unknown key
type '-----END'</p>
<p class="MsoNormal">debug3: key_read: missing keytype</p>
<p class="MsoNormal">debug1: identity file
/home/rancid/.ssh/id_rsa type 1</p>
<p class="MsoNormal">debug1: identity file
/home/rancid/.ssh/id_dsa type -1</p>
<p class="MsoNormal">ssh_exchange_identification: Connection
closed by remote host</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">The relevant part of the firewall config:</p>
<p class="MsoNormal">ssh scopy enable</p>
<p class="MsoNormal">ssh y.y.y.y z.z.z.z outside</p>
<p class="MsoNormal">ssh 0.0.0.0 0.0.0.0 inside</p>
<p class="MsoNormal">ssh timeout 30</p>
<p class="MsoNormal">ssh key-exchange group dh-group1-sha1</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">I suspect the key-exchange group line is
the issue, but dang if I can figure out how to resolve it. I
do not have any problems with using ssh on any other device at
all. So yes, I have an id_rsa file that seems to be just fine
since I connect to all the other devices.</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">The /etc/ssh/ssh_config file is only
comments, no commands in there. If I try to add a line for
KexAlgorithms, ssh gives me an error, ‘bad configuration
option’.</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">ssh –V => OpenSSH_5.1p1, OpenSSL 0.9.8i
15 Sep 2008</p>
<p class="MsoNormal">ssh –Q is not a valid option</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">Any ideas?</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">Thanks,</p>
<p class="MsoNormal">Wayne</p>
<p class="MsoNormal"> </p>
</div>
<br>
<hr>
<font face="Arial" color="Blue" size="1"><br>
The information in this Internet e-mail (and any attachments) is
confidential, may be legally privileged and is intended solely
for the Addressee(s) named above. If you are not the intended
recipient, or the employee or agent responsible for delivering
it to the intended recipient, then any dissemination or copying
of this e-mail (and any attachments) is prohibited and may be
unlawful. If you received this e-mail in error, please
immediately notify us by e-mail or telephone, then delete the
message. Thank you.<br>
</font>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
Rancid-discuss mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Rancid-discuss@shrubbery.net">Rancid-discuss@shrubbery.net</a>
<a class="moz-txt-link-freetext" href="http://www.shrubbery.net/mailman/listinfo/rancid-discuss">http://www.shrubbery.net/mailman/listinfo/rancid-discuss</a></pre>
</blockquote>
<br>
<div class="moz-signature">-- <br>
<table>
<tbody>
<tr>
<td style="padding-left: 20px" width="90%">Doug Hughes<br>
Keystone NAP<br>
Fairless Hills, PA<br>
1.844.KEYBLOCK (539.2562)</td>
<td style="align: right;padding-right: 20px"><img
src="cid:part1.FD8D24A5.544F3846@keystonenap.com">
</td>
</tr>
</tbody>
</table>
</div>
</body>
</html>