0

When trying to access a Cisco VM router in a GNS3 environment I'm getting the error: SSH protocol v.1 is no longer supported when I'm using the command sshpass -p Cisco ssh Cisco@192.168.224.7 -1.

I think I can edit /etc/ssh/ssh_config to allow this but unsure of the option to do so. Is there either way to force ssh version 1?

This is just a lab, yes it's insecure, I don't care. I want to force this to make something I'm doing easier. Is there an ssh program in Linux that does just this or can I edit the configuration file to force to allow version 1?

Also, this is a Ubuntu VM that I'm using to try to ssh into this Cisco VM router, its actually WSL v2.

7
  • Modern versions of OpenSSH have dropped support for protocol v1 specifically because it's insecure, so the answer is that you probably can't do that. Also, it seems a bit odd to come to Information Security Stack Exchange and specifically ask about how to do something that's insecure without caring about its security.
    – bk2204
    Mar 19 at 2:46
  • I was not aware that I was in the internet security section, sorry about this. Yes I'm aware its insecure, don't care. I'm creating these VM for minutes at a time for ansible and learning sessions. I'll try to find the proper section, thanks bk2204. Mar 19 at 2:49
  • What does show ip ssh show? Mar 19 at 3:23
  • 1
    R1(config)#do show ip ssh SSH Enabled - version 1.5 Authentication timeout: 60 secs; Authentication retries: 2 Minimum expected Diffie Hellman key size : 1024 bits IOS Keys in SECSH format(ssh-rsa, base64 encoded): ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAAQQCiKFVorqnkdAZtZ0N98t6vLCUz8z7iEDuWi5TDrXZN BLAhhigP6p9qlpLnEjLDi8LaFpC0sdY0YRJiHbMUKNYz Mar 19 at 3:34
  • Odd it says version 1.5 Mar 19 at 3:38

2 Answers 2

2

SSHv1 support was completely removed in OpenSSH version 7.6. There's no option to "force" or "reenable" it – the SSHv1 code literally no longer exists within the ssh program. (Unless you keep an old version around.)

As you mention in comments, your router does actually support SSHv2, just with an outdated set of algorithms. You can re-enable some of them in modern OpenSSH versions, with an ~/.ssh/config similar to this:

Host 192.168.224.7
    Ciphers +aes128-cbc,aes256-cbc,3des-cbc
    KexAlgorithms +diffie-hellman-group14-sha1
    HostkeyAlgorithms +ssh-rsa
    PubkeyAcceptedAlgorithms +ssh-rsa

But to access old systems in general, you can use the plink client from PuTTY which supports SSHv1 and many obsolete SSHv2 ciphers (yes, it has a native Linux version) – or just telnet into the router instead.

plink Cisco@192.168.224.7

(You don't need sshpass for it, because plink already has the -pw option to specify a password.)

0

On the client side, pass -1 flag to ssh which forces ssh to try protocol version 1 only.

https://linux.die.net/man/1/ssh

You may need to downgrade the router to allow version 1 ssh. It's likely set to allow version 2 only. Try ip ssh version 1 to allow version 1.

1
  • The OP already said they tried -1.
    – schroeder
    Mar 19 at 17:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.