3

While we are upgrading our clusters, we noticed there are some legacy nodes that use very old version of openssh. Our current SSH clients cannot talk to them. How do we temporary install weak cipher to upgrade those nodes?

Here are the command logs

[~] ssh username@node.legacy
Unable to negotiate with 10.10.10.10 port 22: no matching cipher found. Their offer: arcfour,arcfour128,arcfour256

Supported ciphers

[~] ssh -Q cipher
3des-cbc
aes128-cbc
aes192-cbc
aes256-cbc
rijndael-cbc@lysator.liu.se
aes128-ctr
aes192-ctr
aes256-ctr
aes128-gcm@openssh.com
aes256-gcm@openssh.com
chacha20-poly1305@openssh.com

We have tried the following and it's not working.

[~] ssh -vv -c arcfour username@node.legacy
Unknown cipher type 'arcfour'
  • install an old version of OpenSSH as icky-old-ssh somewhere and then use that until the old nodes can be put out to pasture? – thrig Apr 4 '18 at 14:03
  • 1
    A host-based .ssh/config file could help, too — so you’re only using insecure ciphers where you need to – Jeff Schaller Apr 4 '18 at 14:05
  • True, Stephen — just trying to limit the damage, in case the ssh default configuration does not include the insecure ciphers, they do not need to be added globally – Jeff Schaller Apr 4 '18 at 14:07
  • Yeah I realised that with your extended comment (which is why I deleted my comment). I agree an icky-old-SSH would be safer with a .ssh/config set up correctly. – Stephen Kitt Apr 4 '18 at 14:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.