ssh stuck at SSH2_MSG_KEX_DH_GEX_REQUEST when trying to access CHR v7+ on GCE

RouterOS General
1

I’ve been trying out the cloud hosted router on Google Cloud, using v6.48.3, with no issue. Wanting to check the wireguard support of ROS7 out, I upgraded to v7.4.1. After the upgrade, ssh would not log in anymore. It would get stuck at SSH2_MSG_KEX_DH_GEX_REQUEST and then timeout after a while with “auth timeout”

The client ssh is the SSH from Ubuntu 20.04, OpenSSH_8.2p1 Ubuntu-4ubuntu0.5, OpenSSL 1.1.1f 31 Mar 2020

Since I’ve seen some ssh-related changes in 7.3 and 7.4, I tried the latest minor versions from 7.1 and 7.2, but no change. Also tried to install the CHR whole disk image, also no change. Reinstalling 6.48.3 works again.

Any idea what could be happening ?

Output of ssh -v (minus some IPs and stuff):

OpenSSH_8.2p1 Ubuntu-4ubuntu0.5, OpenSSL 1.1.1f 31 Mar 2020
debug1: Reading configuration data /home/doudou/.ssh/config
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: include /etc/ssh/ssh_config.d/*.conf matched no files
debug1: /etc/ssh/ssh_config line 21: Applying options for *
debug1: Connecting to XXXXXX.
debug1: Connection established.
debug1: identity file /home/doudou/.ssh/id_rsa type 0
debug1: identity file /home/doudou/.ssh/id_rsa-cert type -1
debug1: identity file /home/doudou/.ssh/id_dsa type -1
debug1: identity file /home/doudou/.ssh/id_dsa-cert type -1
debug1: identity file /home/doudou/.ssh/id_ecdsa type -1
debug1: identity file /home/doudou/.ssh/id_ecdsa-cert type -1
debug1: identity file /home/doudou/.ssh/id_ecdsa_sk type -1
debug1: identity file /home/doudou/.ssh/id_ecdsa_sk-cert type -1
debug1: identity file /home/doudou/.ssh/id_ed25519 type -1
debug1: identity file /home/doudou/.ssh/id_ed25519-cert type -1
debug1: identity file /home/doudou/.ssh/id_ed25519_sk type -1
debug1: identity file /home/doudou/.ssh/id_ed25519_sk-cert type -1
debug1: identity file /home/doudou/.ssh/id_xmss type -1
debug1: identity file /home/doudou/.ssh/id_xmss-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_8.2p1 Ubuntu-4ubuntu0.5
debug1: Remote protocol version 2.0, remote software version ROSSSH
debug1: no match: ROSSSH
debug1: Authenticating to XXXXX
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: algorithm: diffie-hellman-group-exchange-sha256
debug1: kex: host key algorithm: rsa-sha2-256
debug1: kex: server->client cipher: aes192-ctr MAC: hmac-sha2-256 compression: none
debug1: kex: client->server cipher: aes192-ctr MAC: hmac-sha2-256 compression: none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(2048<8192<8192) sent
^C

2

Noone ? No idea … ?

3

http://forum.mikrotik.com/t/cannot-ssh-to-mikrotik-rb750-with-dsa-key/125060/1

/ip ssh regenerate-host-key
4

Right. So, this was an install from scratch of a brand new firmware … regenerating the host key was unlikely to solve anything (and indeed nothing got solved by it).

What I had to do to make it work:

  • explicitly set hmac-sha2-256 as the MAC on the openssh side
  • disable SetEnv stanzas (I had some that were setting git-related environment)

Without the latter, I would not get a terminal. With the former, it would simply not pass the key exchange phase.