Diameter Signaling Router (DSR): Sshd Configuration Changes Post Upgrade

Asset ID:	1-72-2400370.1
Update Date:	2018-05-29
Keywords:

Solution Type Problem Resolution Sure

Solution 2400370.1 : Diameter Signaling Router (DSR): Sshd Configuration Changes Post Upgrade

Applies to:

Oracle Communications Diameter Signaling Router (DSR) - Version DSR 7.2.0 and later
Tekelec

Symptoms

Once Server completes the upgrade from 7.2.0 to 8.2.1 version, user will be unable to ssh the server.

root@server#ssh x.x.x.x
no matching mac found: client hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96 server hmac-sha2-512,hmac-sha2-256

Changes

When servers gets upgraded to 8.2 version.

Cause

Upgraded server whose version is 8.2 does not support the existing MACs. ie client hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96 server hmac-sha2-512,hmac-sha2-256

8.2 DSR version recommends the below MACs for SSH connections. They are stronger than the ones used earlier.

root@server#sshd -T | grep macs
macs hmac-sha2-512, hmac-sha2-256

Solution

The preferred course of action is to use an up to date ssh client.

Also as a workaround, you can update "/etc/ssh/sshd_config" file with "macs hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96" and hash out(#) the existing ones ie "macs hmac-sha2-512, hmac-sha2-256".

Attachments

This solution has no attachment