Cisco Router, SSH, PubKey, ...
Intro
I stumbled across an old Cisco box in the basement. I thought i might have some fun (or frust?) with the aging Device. The Hardware still works fine, right ? And what about the Software ? Let’s give a try !
Hardware
show version
Cisco 1841 (revision 7.0) with 352256K/40960K bytes of memory.
Processor board ID FCZ1234757Y
6 FastEthernet interfaces
1 Virtual Private Network (VPN) Module
DRAM configuration is 64 bits wide with parity disabled.
191K bytes of NVRAM.
125184K bytes of ATA CompactFlash (Read/Write)
Configuration register is 0x2102
Software
dir flash
System image file is "flash:c1841-adventerprisek9-mz.151-4.M10.bin"
System image file is "flash:c1841-advipservicesk9-mz.124-25g.bin"
Factory Reset
r112#wr erase
Erasing the nvram filesystem will remove all configuration files! Continue? [confirm]
[OK]
Erase of nvram: complete
r112#reload
Jan 2 12:10:07.427: %SYS-7-NV_BLOCK_INIT: Initialized the geometry of nvram
System configuration has been modified. Save? [yes/no]: no
Proceed with reload? [confirm]
Jan 2 12:10:17.603: %SYS-5-RELOAD: Reload requested by console. Reload Reason: Reload Command.
System Bootstrap, Version 12.4(13r)T, RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 2006 by cisco Systems, Inc.
PLD version 0x10
GIO ASIC version 0x127
c1841 platform with 393216 Kbytes of main memory
Main memory is configured to 64 bit mode with parity disabled
Settings
do some basic settings
conf t
no ip domain lookup
hostname router-template
line con 0
logging synchronous
line vty 0 15
logging synchronous
end
DNS
configure dns
conf t
ip name-server 9.9.9.9
ip domain lookup
end
ping 9.9.9.9
ping www.google.com
NTP
add two nameservers
conf t
ntp server time.metas.ch prefer
ntp server 0.ch.pool.ntp.org
end
Time Zone
set the right timezone …
conf t
clock timezone CET +1
clock summer-time CEST recurring last Sun Mar 2:00 last Sun Oct 3:00
end
Logging
configure logging correctly
conf t
service timestamps log datetime localtime show-timezone
logging console errors
logging buffered 64000
end
Security
encrypt password / set enable password
conf t
service password-encryption
enable secret XxXxXxXxXxXxX
end
Enable SSH
remove old key
conf t
crypto key zeroize rsa
end
2k Keylength
conf t
crypto key generate rsa modulus 2048
end
… or go with 4k …
4k Keylength -> this is gonna take while (5 min) depending on your hardware !
conf t
crypto key generate rsa modulus 4096
end
configure SSH
conf t
ip ssh version 2
ip ssh time-out 60
ip ssh authentication-retries 2
username cisco privilege 15 password xXxXxXxXxXxXx
line vty 0 15
transport input ssh
login local
end
Test ssh
ssh -l cisco 192.168.5.209
user@nixbox$ ssh -l cisco 192.168.5.209
(cisco@192.168.5.209) Password:
router-template#
-> sucess !
SSH Keygen on *nix Maschine
i mostly use ed25519 Keys on my Boxes, so, there is no RSA Key at the Moment.
RSA Key, 2048 Bit
ssh-keygen -t rsa -b 2048
user@nixhost$ ssh-keygen -t rsa -b 2048
Generating public/private rsa key pair.
Enter file in which to save the key (/home/user/.ssh/id_rsa):
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /home/user/.ssh/id_rsa
Your public key has been saved in /home/user/.ssh/id_rsa.pub
The key fingerprint is:
SHA256:cfLCL3kZCJaodgAA9TTpnN/O2BkYjw6exvXU7px96eg user@nixhost
The key's randomart image is:
+---[RSA 2048]----+
|*.. o. |
| . o.o . |
| .oo.+ o . |
| o+..o * |
| o .. *S.o |
| . .. = =+.o |
| o = Bo++ . |
| = o *+.o .o |
| . .+.Eo. |
+----[SHA256]-----+
Format KeyString
the Cisco Box needs the Key with special line length. There is no Chance to copy/paste the public key in just one line (thanks for that, cisco)
cat ~/.ssh/id_rsa.pub |cut -d" " -f 2 |fold -b -w 64
user@nixbox$ cat ~/.ssh/id_rsa.pub |cut -d" " -f 2 |fold -b -w 64
AAAAB3NzaC1yc2EAAAADAQABAAABAQC8UxE839WIIXVlwqn/X6NrRMoesuQMYozS
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Add Pubkey to Router
create a user called “user” and add the public key like this
conf t
ip ssh pubkey-chain
username user
key-string
AAAAB3NzaC1yc2EAAAADAQABAAABAQC8UxE839WIIXVlwqn/X6NrRMoesuQMYozS
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
exit
exit
exit
exit
Confirm Pubkey
confirm that your key got installed correctly …
show running-config | section pubkey
router-template#show running-config | section pubkey
ip ssh pubkey-chain
username user
key-hash ssh-rsa 80ADCCB62636783A0A6B5E1E28F23CE0
quit
Login with Key Only
and try to login with Key only. unfortunately that does not work as expected …
ssh -o PreferredAuthentications=pubkey -o KexAlgorithms=+diffie-hellman-group-exchange-sha1 -o HostKeyAlgorithms=+ssh-rsa -c aes128-cbc -l user 192.168.5.209
-> the router just supports really old crypto ciphers so we have to downgrade and update our ssh config file :(
update .ssh/config
cat << 'EOF' >> ~/.ssh/config
Host 192.168.5.209
KexAlgorithms +diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
HostKeyAlgorithms +ssh-rsa
Ciphers +aes128-cbc
EOF
user@nixbox$ ssh -l user 192.168.5.209
user@192.168.5.209: Permission denied (publickey,keyboard-interactive,password).
i enabled “debug ip ssh” and got some wired Debug Message on the Cisco Box. Couldn’t find a Solution on Google & Friends :(
wired debug messages
SSH0: Session disconnected - error 0x00
Upgrade/Downgrade IOS Image
Let’s switch to another IOS Image …
First approach is to copy the Image from the UnixBox to the Router. I’d preferre SSH/SCP and not the legacy TFTP/FTP Stuff.
enable scp server on the router
conf t
ip scp server enable
end
push the Image to the Router
scp ~/c181x-adventerprisek9-mz.151-4.M12a.bin cisco@192.168.5.209:c181x-adventerprisek9-mz.151-4.M12a.bin
-> not sucessfull. couldn’t copy the “old” Image from my UnixBox to the Router via scp :(
2nd try: pull the image from the Router. also with scp !
update /etc/ssh/sshd_config on the Unix ox
Ciphers aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes128-cbc,3des-cbc
HostKey /etc/ssh/ssh_host_ed25519_key
HostKey /etc/ssh/ssh_host_rsa_key
HostKeyAlgorithms ssh-ed25519,ssh-ed25519-cert-v01@openssh.com,sk-ssh-ed25519-cert-v01@openssh.com,sk-ssh-ed25519@openssh.com,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-rsa
and restart the ssh daemon
rcctl restart sshd
ssh from router to server
router-template#ssh -l user 192.168.5.1
Password:
Last login: Tue Jul 26 20:41:16 2022 from 192.168.5.209
OpenBSD 7.1 (GENERIC.MP) #3: Sun May 15 10:27:01 MDT 2022
-> ssh login works from the router
try to copy from the server to router
user@nixbox$ ll /home/user/c181x-adventerprisek9-mz.151-4.M12a.bin
-rw-r--r-- 1 user user 30583572 Jul 26 20:32 /home/user/c181x-adventerprisek9-mz.151-4.M12a.bin
router-template#copy scp://user@192.168.5.1:/c181x-adventerprisek9-mz.151-4.M12a.bin flash:/c181x-adventerprisek9-mz.151-4.M12a.bin
Destination filename [c181x-adventerprisek9-mz.151-4.M12a.bin]?
Password:
scp: debug1: fd 3 clearing O_NONBLOCK
Sending file modes: C0644 30583572 c181x-adventerprisek9-mz.151-4.M12a.bin
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
-> this seems working and needs a few minutes …
set Boot Variable
conf t
boot system flash:c181x-adventerprisek9-mz.151-4.M12a.bin
end
wr
reboot
… and the router stop in rommon :(
System Bootstrap, Version 12.4(13r)T, RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 2006 by cisco Systems, Inc.
PLD version 0x10
GIO ASIC version 0x127
c1841 platform with 393216 Kbytes of main memory
Main memory is configured to 64 bit mode with parity disabled
Readonly ROMMON initialized
program load complete, entry point: 0x8000f000, size: 0xcb80
program load complete, entry point: 0x8000f000, size: 0xcb80
loadprog: error - Invalid image for platform
e_machine = 147, cpu_type = 134
boot: cannot load "flash:"
-> Invalid image for platform
let’s boot the previous image (always keep more then one image on the flash if possible !)
boot flash:c1841-adventerprisek9-mz.151-4.M10.bin
Try again with 12.4
another try with an Image for the 1841, v12.4-25G
copy scp://user@192.168.5.1:/c1841-advipservicesk9-mz.124-25g.bin flash:/c1841-advipservicesk9-mz.124-25g.bin
conf t
no boot system
boot system flash c1841-advipservicesk9-mz.124-25g.bin
end
wr
show flash content
router-template#dir flash:
Directory of flash:/
2 -rw- 47454756 Jun 7 2015 14:07:44 +02:00 c1841-adventerprisek9-mz.151-4.M10.bin
3 -rw- 2732032 Jul 26 2022 21:16:26 +02:00 c1841-advipservicesk9-mz.124-25g.bin
downgrade of Software aborted … Version 12.4 handle SSH & Cryptographie kind of different. Not interested to go another step back in history …
Summary
so, it was quite interesting to see how many “botches, work arounds and Downgrades” needs to implemented and i still was note able to Login with SSH & Pubkey to my old Router Box. I think i should give them away to someone who want’s to learn and make his hands dirty.
Follup Up with AAA
got some support from a nice Cisco Guy and tried a few things …
conf t
crypto key generate rsa usage-keys label router-key
aaa new-model
aaa authentication login default local
aaa authorization exec default local if-authenticated
end
Error Messages on the Router …
router-template#
Jul 29 08:47:30.671: SSH0: starting SSH control process
Jul 29 08:47:30.671: SSH0: sent protocol version id SSH-2.0-Cisco-1.25
Jul 29 08:47:30.675: SSH0: protocol version id is - SSH-2.0-OpenSSH_9.0
Jul 29 08:47:30.679: SSH2 0: SSH2_MSG_KEXINIT sent
Jul 29 08:47:30.683: SSH2 0: SSH2_MSG_KEXINIT received
Jul 29 08:47:30.683: SSH2:kex: client->server enc:aes128-cbc mac:hmac-sha1
Jul 29 08:47:30.683: SSH2:kex: server->client enc:aes128-cbc mac:hmac-sha1
Jul 29 08:47:30.879: SSH2 0: SSH2_MSG_KEX_DH_GEX_REQUEST received
Jul 29 08:47:30.879: SSH2 0: Range sent by client is - 2048 < 4096 < 8192
Jul 29 08:47:30.879: SSH2 0: Modulus size established : 4096 bits
Jul 29 08:47:31.499: SSH2 0: expecting SSH2_MSG_KEX_DH_GEX_INIT
Jul 29 08:47:31.503: SSH2 0: SSH2_MSG_KEXDH_INIT received
Jul 29 08:47:33.050: SSH2: kex_derive_keys complete
Jul 29 08:47:33.050: SSH2 0: SSH2_MSG_NEWKEYS sent
Jul 29 08:47:33.050: SSH2 0: waiting for SSH2_MSG_NEWKEYS
Jul 29 08:47:33.082: SSH2 0: SSH2_MSG_NEWKEYS received
Jul 29 08:47:33.286: SSH2 0: Using method = none
Jul 29 08:47:33.290: SSH2 0: SSH ERROR closing the connection
Jul 29 08:47:33.390: SSH0: Session disconnected - error 0x00
stupid double fault :(
oh man … what a stupid error. User “user” must also exists on the router. And OpenBSD is still not able to login. A Standrd Debian Box is doing fine …
add user ‘user’
conf t
username user privilege 15 password xXxXxXxXxXxXx
end
OpenBSD SSH Debug
OpenBSD still refuses to work, so, need some more investigation.
ssh -vvv
debug1: Found key in /home/user/.ssh/known_hosts:1
debug1: rekey out after 4294967296 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: rekey in after 4294967296 blocks
debug1: Will attempt key: .ssh/id_rsa RSA SHA256:wbJ/kzgZ5jpAGo56/f4MMsqUO3IgBc1o8l1X7UwEx90 explicit
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,keyboard-interactive,password
debug1: Next authentication method: publickey
debug1: Offering public key: .ssh/id_rsa RSA SHA256:wbJ/kzgZ5jpAGo56/f4MMsqUO3IgBc1o8l1X7UwEx90 explicit
debug1: send_pubkey_test: no mutual signature algorithm
debug1: Next authentication method: keyboard-interactive
(user@192.168.5.209) Password:
send_pubkey_test: no mutual signature algorithm
SSH FIXED !
finally did it …
cat << 'EOF' >> .ssh/config
Host 192.168.5.209
KexAlgorithms +diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
HostKeyAlgorithms +ssh-rsa
Ciphers +aes128-cbc
MACs +hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96
PubkeyAcceptedKeyTypes +ssh-rsa
EOF
-> PubkeyAcceptedKeyTypes +ssh-rsa this was the missing Line …
Best do add this Part the the /etc/ssh_config, so, it will be valid for all upcomming SSH Sessions.
ok, at least fixed and documented. for me or for someone else ;)
Any Comments ?
sha256: 29d09153c4851f1e64a1291762cf2a80ae79053cf421ac60fb443fd49c21cdbb