0

A router is configured with DD-WRT and features remote SSH access. A raspberry pi computer (Raspbian) is connected to the router's LAN. Once logged into the router via SSH, attempts to SSH from the router into the pi returns:

ssh pi@192.168.8.151

ssh: connection to pi@192.168.8.151:22 exited: no matching algo kex

Shelling into other LAN connected DD-WRT routers from the DD-WRT Gateway is successful.

Questions:

  1. What is the cause of the error message and what can be done to enable SSH access?
  2. What exactly does no matching algo kex imply?

UPDATES

ssh pi@192.168.8.96 -oKexAlgorithms=+diffie-hellman-group1-sha1

WARNING: Ignoring unknown argument '-oKexAlgorithms=+diffie-hellman-group1-sha1' ssh: connection to pi@192.168.8.96:22 exited: no matching algo kex

user@raspberrypi:~ $ ssh -V

OpenSSH_6.7p1 Raspbian-5+deb8u2, OpenSSL 1.0.1t 3 May 2016

DD-WRT is running dropbear v0.52:

user@DD-WRT:~ $ ssh -V

WARNING: Ignoring unknown argument '-v' Dropbear client v0.52 Usage: ssh [options] [user@]host[/port][,[user@]host/port],...] [command] Options are:

-p -l -t Allocate a pty -T Don't allocate a pty -N Don't run a remote command -f Run in background after auth -y Always accept remote host key if unknown -s Request a subsystem (use for sftp) -i (multiple allowed) -L Local port forwarding -g Allow remote hosts to connect to forwarded ports -R Remote port forwarding -W (default 24576, larger may be faster, max 1MB) -K (0 is never, default 0) -I (0 is never, default 0) -B Netcat-alike forwarding -J Use program pipe rather than TCP connection

  • I think it's something to do with the software versions being a bit too different. I feel like that's too vague to be an Answer, but it could be a starting point to look at. I mean, what does ssh -V return on each side? (That is, on the raspberry and on the router?) – Ed Grimm Mar 8 at 0:52
  • Great idea: results posted for analysis & comments :) Because I can access the rPi from Putty and an Ubuntu CLI, I am inclined to think the problem is on the DD-WRT (dropbear?) side. – gatorback Mar 8 at 1:13
  • 1
    Is adding -oKexAlgorithms=+diffie-hellman-group1-sha1 as ssh parameter solves this question? – Geno Chen Mar 8 at 1:26
  • @GenoChen Results of suggestion posted in updates. Uncertain if syntax is correct: suggestions appreciated. – gatorback Mar 8 at 2:38
0

Try checking both the SSH client and server cyphers. Probably your (up to date) client has some outdated cyphers disabled, and the client and server cypher list don't match.

0

Your Raspberry Pi's ssh software is a little old, but in this case, that actually made this issue less likely to occur.

Your DD-WRT software is from 2008, which is ancient in terms of IT Security. dropbear isn't even using that style of version number any more (current is apparently 2018.76). That really should be updated for a lot of other reasons, but also this.

I'd personally recommend you apply available updates to both products, but I'd do the router first.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.