Ubuntu 20.04 unable to ssh to Cisco IOS

Had a Ubuntu 18.x control workstation with the ability to ssh to Cisco network devices. This workstation received an upgrade to 20.04 last evening. Everything on client side appeared to well but unable to ssh to devices.

Built new Ubuntu 20.04 VM with same results.

Ubuntu Control Station:

ssh [email protected]
Unable to negotiate with 10.1.251.231 port 22: no matching key exchange method found. Their offer: diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1

Router response:

Oct  4 06:07:10.126: %SSH-3-NO_MATCH: No matching kex algorithm found: client curve25519-sha256,[email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,ext-info-c server diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1

I came across some other documentation which I followed the instructions with no success and the same condition.

By default, when Ubuntu is first installed, remote access via SSH is not allowed. Enabling SSH on Ubuntu is fairly straightforward.

sudo apt update
sudo apt install openssh-server

You can verify that SSH is running by typing: sudo systemctl status ssh

sudo systemctl status ssh

Output:

ssh.service - OpenBSD Secure Shell server
    Loaded: loaded (/lib/systemd/system/ssh.service; enabled; vendor preset: enabled)
    Active: active (running) since Mon 2020-06-01 12:34:00 CEST; 9h ago

Ubuntu ships with a firewall configuration tool called UFW. If the firewall is enabled on your system, make sure to open the SSH port:

sudo ufw allow ssh

Looking for a solution to ssh to Cisco IOS.

Thanks in Advance.

Solution 1:

Ubuntu 20.04 deprecated some more insecure algorithms. To re-enable them you can create a conf file in /etc/ssh/ssh_config.d/ with the options you need.

For example (based on your router's response):

echo "KexAlgorithms diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1" >>/etc/ssh/ssh_config.d/weak.conf