I recently followed the advice at this blog to tighten down my SSH security, which included restricting key exchange algorithms to ones not vulnerable to known (or assumed known) capabilities of Prime attacks on DH.
I'm happy with the setup and it's working well, but since putting this in place on my server, I'm now seeing lots of messages like these in the logs:
sshd[19853]: fatal: Unable to negotiate with XXX: no matching key exchange method found. Their offer: diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 [preauth]
This doesn't concern me, this is the usual random connections to port 22 I was seeing previously, except now they are being rejected at at key exchange instead of during user auth attempt (ie. trying to login as root, oracle, etc).
I am the only user on the host so all of these are probe/hack attempts. But it's interesting to me that the majority of attempted connections focus on these algorithms. Here's the breakdown of the most common signatures I see:
> journalctl -n 1000 | grep sshd | grep "no matching key exchange" | sed -r 's/.*Their offer: (.*) \[preauth\]/\1/' | sort | uniq -c
2 diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256
4 diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,diffie-hellman-group14-sha1
1 diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
63 diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1
411 diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1
For the most common one diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1, I'm curious if this is a specific signature (ie. perhaps this is the default in certain older versions of SSH) or if this is an indication of hackers purposely restricting key exchange to focus on these weaker algorithms.
My google searching turns up nothing of value so I'm turning to this community in hopes of someone here having seen and researched this before. More curiosity than a problem to solve, but still hoping someone here has the knowledge to satisfy the curiosity. :)