topic Hi again in Network Security

suddenly cant do ssh to ASA box

kthned — Tue, 12 Mar 2019 07:40:05 GMT

I have 2xASA 5585 configured with multiple context running 9.4 (1) code base. During weekend, suddenly I missed ssh to the active ASA.

ssh ASA.ip

ssh_exchange_identification: Connection closed by remote host

debug ssh on the firewall gives

Device ssh opened successfully.
SSH1: SSH client: IP = 'x.x.x.x' interface # = 262147
SSH: unable to retrieve default host public key. Please create a defauth RSA key pair before using SSH
SSH0: Session disconnected by SSH server - error 0x00 "Internal error"

sh crypto key mypubkey rsa
Key pair was generated at: 09:15:48 CEDT Oct 8 2012
Key name: <Default-RSA-Key>
Usage: General Purpose Key
Modulus Size (bits): 2048
Key Data:

I have already a ssh-public-rsa key. But when I re-created it still failing...

crypto key generate rsa modulus 2048
WARNING: You have a RSA keypair already defined named <Default-RSA-Key>.

Do you really want to replace them? [yes/no]: yes
Keypair generation process begin. Please wait...
% Attempt to generate RSA keys failed:

Two questions !

1. Any clue why I missed ssh service... Also can not connect via ASDM... is it due to old RSA key generated Oct 8 2012 ? BUG ?

2. Shall zerioze the ssh do the job ?

Thanks in advance !

//Umair

Was there perhaps a failover

Marvin Rhoads — Tue, 26 Apr 2016 03:28:01 GMT

Was there perhaps a failover event and the secondary active unit does not have an RSA key?

"show failover history" and check for recent failover.

I'd open a TAC case if 30 minutes of checking didn't reveal an obvious answer.

have you made sure that all

Marius Gunnerud — Tue, 26 Apr 2016 05:50:59 GMT

have you made sure that all relevant ssh and aaa config is present. Perhaps someone has removed the config by accident.

show run ssh

show run aaa

Please remember to select a correct answer and rate helpful posts

Nothing change on the ssh or

kthned — Tue, 26 Apr 2016 09:02:23 GMT

Nothing change on the ssh or aaa configuratuions 😞

Hi,

Aditya Ganjoo — Tue, 26 Apr 2016 09:22:41 GMT

Hi,

Since you have lost access to ASDM as well it seems some piece of config is missing.

Could you share the config of the active ASA ?

Regards,

Aditya

Here is the ssh config from

kthned — Tue, 26 Apr 2016 12:52:51 GMT

Here is the ssh config from active context

/admin/act(config)# sh running-config ssh

ssh stricthostkeycheck
ssh 172.32.17.0 255.255.255.0 outside
ssh timeout 15
ssh key-exchange group dh-group1-sha1

Interestingly ASA is listening to the ports

admin/act(config)# show asp table socket

Protocol Socket State Local Address Foreign Address

TCP 02f2f108 LISTEN 172.18.10.39:22 0.0.0.0:*

SSL 02f2f6c8 LISTEN 172.18.10.39:443 0.0.0.0:*

Do you see username prompt

Aditya Ganjoo — Tue, 26 Apr 2016 13:10:19 GMT

Do you see username prompt when you do SSH ?

Please share the output of show run all ssl ?

it actually gives the same

kthned — Tue, 26 Apr 2016 15:03:23 GMT

it actually gives the same output.

As I wrote earlier... when I ssh to asa... the response is the following and i did not get any prompt. Generating the key also failed as discussed in the first post.

ssh ASA.ip

ssh_exchange_identification: Connection closed by remote host

admin/act# sh running-config all ssl
ssl server-version tlsv1
ssl client-version tlsv1
ssl cipher default medium
ssl cipher tlsv1 medium
ssl cipher tlsv1.1 medium
ssl cipher tlsv1.2 medium
ssl cipher dtlsv1 medium
ssl dh-group group2
ssl ecdh-group group19
ssl certificate-authentication fca-timeout 2

it actually gives the same

kthned — Tue, 26 Apr 2016 15:04:03 GMT

it actually gives the same output.

As I wrote earlier... when I ssh to asa... the response is the following and i did not get any prompt. Generating the key also failed as discussed in the first post.

ssh ASA.ip

ssh_exchange_identification: Connection closed by remote host

admin/act# sh running-config all ssl
ssl server-version tlsv1
ssl client-version tlsv1
ssl cipher default medium
ssl cipher tlsv1 medium
ssl cipher tlsv1.1 medium
ssl cipher tlsv1.2 medium
ssl cipher dtlsv1 medium
ssl dh-group group2
ssl ecdh-group group19
ssl certificate-authentication fca-timeout 2

Hi Aditya

kthned — Tue, 26 Apr 2016 15:10:53 GMT

Hi Aditya

I think ASA is hit by the

ASA5585 ASA-3-402148: CRYPTO: Random Number Generator error

CSCuw36581

sh log gives exactly the same error, started just today !

Hi,

Aditya Ganjoo — Wed, 27 Apr 2016 00:24:31 GMT

Hi,

Yes if you are seeing this log message then in most cases the device has to be replaced.

Could you please upgrade the box to latest interim version of 9.5.2 code which would be asa952-6-smp-k8.bin ?

Regards,

Aditya

Please rate helpful posts.

Hi Aditya

kthned — Wed, 27 Apr 2016 07:23:30 GMT

Hi Aditya

Thanks for your response... what do mean by " device has to be replaced."

Do you have any idea why that happens ? is it a hardware failure ?

Shall I go for restart first ?

Hi,

Aditya Ganjoo — Wed, 27 Apr 2016 07:39:53 GMT

Hi,

By replacing device I mean get a RMA for this ASA if you a valid contract with Cisco.

Before that I would request you to upgrade to the asa952-6-smp-k8.bin and check, if it does not fix it then please go ahead with the RMA option.

Regards,

Aditya

Hi again

kthned — Wed, 27 Apr 2016 08:51:59 GMT

Hi again

Thanks for your help.

Actually the bug fixed in this version does not point to my specific problem. However they say for SSL fixes. I have two firewalls and both have the same ssh problem. Infact the standby firewall is accessible via https (ASDM) but not ssh which is the complete opposite of whats written in CSCux45179

3) Can't login to ASDM
4) SSH management is operational, however.

Can you check the DMA stats

Tristan Cober — Wed, 27 Apr 2016 19:39:03 GMT

Can you check the DMA pool stats from show memory detail? Were you getting any alarms about low memory?

Re: suddenly cant do ssh to ASA box

supertele — Wed, 27 Mar 2019 18:07:33 GMT

Hi buddy, remember what you did before this issue, I have the same problem, It was because I update the iterm component in my Mac book. I have a lot troubles in ASDM console in this OS, and I can´t connect to 9.1.x ASA neither. A hint for you; try to change the ssh version in ASA config. In earlier ASA versions I don`t have any problem.

Re: suddenly cant do ssh to ASA box

Carlosdiasccie — Tue, 27 Sep 2022 13:50:31 GMT

I had this issue with my ASA but it turns out there were no keys on the device I don't know why.
After generating new keys I was able to ssh to the ASA.