Spectrum SSH Legacy Problem

[Arnold Steindl]

Hi everybody,

We installed a new Spectrum Server and migrated from version 10.2.3 to version 10.4.1. With the new server all tools Spectrum uses have a newer version too. Therefore openssh version changed to OpenSSH_7.7p1, OpenSSL 1.0.2n  7 Dec 2017. I saw in the release note that with Version 7.6 it was prohibited to connect to Servers which offer a key length less than 1024 bit.

 

Show ip ssh on the switch shows the following output via putty

The switch has the highest firmware and does not allow a higher keysize than 1024. Furthermore it is written in the manual that the public key keysize is always 896 bit.

 

So show ip ssh gives server key size 1024 and the public key fingerprint gives 896 bit. Connection with putty works, but not with open ssh which tells me that my key length is invalid. The Openssh client does not allow connections to servers with a key length smaller than 1024.

So the connection with putty and the standard ssh of spectrum works but not with openssh. We backup the configs of the switches with a perlscript which uses the Net::SSH::Expect; library and it uses the ssh executable which is in the systems path variable. So those backup script do not work anymore because the login does not function. Does anyone know a workaround for this?

With kind regards,

Arnold

[Catalin Farcasanu]

You should open a support case for this. Maybe they can assist you in configuring the OpenSSH installation to work, if such configuration is possible.

------------------------------
Senior Consultant
SolvIT Networks
------------------------------

[Joseph Ackley]

https://knowledge.broadcom.com/external/article?articleId=133323

[Arnold Steindl]

Hi Joseph, first of all thanks for you answer. As far as I understand it with the solution from the article you posted I can only generate a new key pair on an openssh server which runs inside of an operating system. I want to make an ssh connection to a hp switch which has the hp ssh server in it. Nevertheless I tried the following:

I generated a new key pair and I set the size to 1024

now show ip ssh shows key size is 1024

no show public key, shows 896

Now a try to go to a higher key size

So my problem is that the public key stays on 896 even if I create a new public key pair with 1024. Does anyone else have any ideas?

Best regards,

Arnold

[Jason Volpini]

Hi Arnold

Am no HP expert by any means, but I did do some research - found these HP docs on configuring SSH

https://techhub.hpe.com/eginfolib/networking/docs/switches/YA-YB/15-18/5998-8153_yayb_2530_asg/content/ch08s06.html

https://techhub.hpe.com/eginfolib/networking/docs/switches/YA-YB/15-18/5998-8153_yayb_2530_asg/content/ch08s08.html

Now what is interesting on the first link, is a table showing what lengths the model devices support. So is your device not supporting higher than 896 perhaps? 

------------------------------
Senior Support Engineer
Broadcom
------------------------------

[Arnold Steindl]

Hi Jason,

i can set the key size to 1024 with the ip ssh key-size 1024 command. Nevertheless there is the following section in the manual for the 2650 switch:

so it seems openssh checks the length of the public key and not the internal server size. So at the moment I think its not possible to access this switches with openssh.

With best rgeards,

Arnold

[Arnold Steindl]

Hi,

Thank you all for your replies! Unfortunately the switches are so old that it is not possible to set the key length higher for the ssh2 Version. As far as I see it my only possibility is to backup the switches with a script which uses a different ssh client which does not have so high security standards as openssh.

Again thanks for the hints and the tipps.

Best regards,

Arnold