SSH Access to old 6.9 routers

RouterOS General
1

Thread request: Yes, I know, upgrade the devices. Please avoid related commentary. :slight_smile:

Is SSH access possible with 6.9?

I am unsuccessful using SSH to access an RB951-2n and RB750 running 6.9.The connection attempt hangs. Using verbose mode does not help identify the hang. There is no password prompt.

The last useful message: Enabling compatibility mode for protocol 2.0

I tried the following options:

KexAlgorithms +diffie-hellman-group1-sha1
HostKeyAlgorithms +ssh-dss
PubkeyAcceptedKeyTypes ssh-rsa,ssh-dss*
Protocol 2,1

nmap shows port 22 open.

Thanks. :slight_smile:

2

Given that SSH access was possible with ROS 5.something, in 6.9 it may only be an issue due to a version-specific bug. But the first question is what ssh client do you use? Because with newer ROS releases, /ip ssh set strong-crypto=yes prevents connection to or from older systems which use older=weaker ciphers. So if you are connecting from a newer system with weaker ciphers disabled by default, all sorts of unexpected behaviour may be seen.

3

Along with your reply and walking away overnight, I finally punched through. I needed both of the following options:

-o HostKeyAlgorithms=ssh-dss -o KexAlgorithms=diffie-hellman-group14-sha1

Or in my user .ssh/config:

KexAlgorithms=+diffie-hellman-group14-sha1
HostKeyAlgorithms=+ssh-dss

Now to see if I can get the owner to update the software. :slight_smile: