0

A router is configured with DD-WRT and features remote SSH access. A raspberry pi computer (Raspbian) is connected to the router's LAN. Once logged into the router via SSH, attempts to SSH from the router into the pi returns:

ssh [email protected]

ssh: connection to [email protected]:22 exited: no matching algo kex

Shelling into other LAN connected DD-WRT routers from the DD-WRT Gateway is successful.

Questions:

  1. What is the cause of the error message and what can be done to enable SSH access?
  2. What exactly does no matching algo kex imply?

UPDATES

ssh [email protected] -oKexAlgorithms=+diffie-hellman-group1-sha1

WARNING: Ignoring unknown argument '-oKexAlgorithms=+diffie-hellman-group1-sha1' ssh: connection to [email protected]:22 exited: no matching algo kex

user@raspberrypi:~ $ ssh -V

OpenSSH_6.7p1 Raspbian-5+deb8u2, OpenSSL 1.0.1t 3 May 2016

DD-WRT is running dropbear v0.52:

user@DD-WRT:~ $ ssh -V

WARNING: Ignoring unknown argument '-v' Dropbear client v0.52 Usage: ssh [options] [user@]host[/port][,[user@]host/port],...] [command] Options are:

-p -l -t Allocate a pty -T Don't allocate a pty -N Don't run a remote command -f Run in background after auth -y Always accept remote host key if unknown -s Request a subsystem (use for sftp) -i (multiple allowed) -L Local port forwarding -g Allow remote hosts to connect to forwarded ports -R Remote port forwarding -W (default 24576, larger may be faster, max 1MB) -K (0 is never, default 0) -I (0 is never, default 0) -B Netcat-alike forwarding -J Use program pipe rather than TCP connection

4
  • I think it's something to do with the software versions being a bit too different. I feel like that's too vague to be an Answer, but it could be a starting point to look at. I mean, what does ssh -V return on each side? (That is, on the raspberry and on the router?)
    – Ed Grimm
    Mar 8, 2019 at 0:52
  • Great idea: results posted for analysis & comments :) Because I can access the rPi from Putty and an Ubuntu CLI, I am inclined to think the problem is on the DD-WRT (dropbear?) side.
    – gatorback
    Mar 8, 2019 at 1:13
  • 1
    Is adding -oKexAlgorithms=+diffie-hellman-group1-sha1 as ssh parameter solves this question?
    – Geno Chen
    Mar 8, 2019 at 1:26
  • @GenoChen Results of suggestion posted in updates. Uncertain if syntax is correct: suggestions appreciated.
    – gatorback
    Mar 8, 2019 at 2:38

2 Answers 2

1

Your Raspberry Pi's ssh software is a little old, but in this case, that actually made this issue less likely to occur.

Your DD-WRT software is from 2008, which is ancient in terms of IT Security. dropbear isn't even using that style of version number any more (current is apparently 2018.76). That really should be updated for a lot of other reasons, but also this.

I'd personally recommend you apply available updates to both products, but I'd do the router first.

0

Try checking both the SSH client and server ciphers. Probably your (up to date) client has some outdated ciphers disabled, and the client and server cipher list don't match.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .