SSH disconnected when entering correct password on router using Putty

[adriangreniergarcia]

Whenever I am trying to access 1 router through ssh, it asks me for the username and password but putty window gets closed when I entered the correct password. When entering wrong password, it will ask for the password again but will not close the session. I can connect perfectly using telnet.

Also find a post last year related the same issue, but there is no solution on it

https://community.cisco.com/t5/network-management/ssh-gets-disconnected-when-entering-correct-password-on-router/m-p/4072451#M133973

Please suggest. Thank

[marce1000]

 - Check device software version. Make sure it is not too old. If applicable upgrade to a more recent release, check if the problem persists.

 M.

[adriangreniergarcia]

Hi marce1000,

The router is a cisco ASR1002 with Version 03.16.09.S.  I have another router in the network with same version and hardware, and they works fine.

[Richard Burts]

One way to investigate this would be to run debug for ssh on the router, attempt access using ssh, when it fails access the router using telnet and look in the log file for debug output. (make sure that the logging level for buffered logging is debug rather than some other level)

[Leo Laohoo]

Telnet into the router and post the output to the command "sh log".
If the SSH session gets prematurely terminated the reason would show up in the logs.

[adriangreniergarcia]

See the logs how the session is closed at the same second. Also below I put the configuration.

006898: Apr 23 22:24:36 UTC: %SSH-5-SSH2_SESSION: SSH2 Session request from xx.xx.xx.xx (tty = 0) using crypto cipher 'aes256-ctr', hmac 'hmac-sha1' Succeeded
006899: Apr 23 22:24:43 UTC: %SSH-5-SSH2_USERAUTH: User 'mia20037' authentication for SSH2 Session from xx.xx.xx.xx (tty = 0) using crypto cipher 'aes256-ctr', hmac 'hmac-sha1' Succeeded
006900: Apr 23 22:24:43 UTC: %SSH-5-SSH2_CLOSE: SSH2 Session from xx.xx.xx.xx (tty = 0) for user 'mia20037' using crypto cipher 'aes256-ctr', hmac 'hmac-sha1' closed

xxxx#show ip ssh
SSH Enabled - version 2.0
Authentication methods:publickey,keyboard-interactive,password
Authentication Publickey Algorithms:ssh-rsa
Hostkey Algorithms:x509v3-ssh-rsa,ssh-rsa
Encryption Algorithms:aes256-ctr
MAC Algorithms:hmac-sha1
Authentication timeout: 120 secs; Authentication retries: 3
Minimum expected Diffie Hellman key size : 2048 bits
IOS Keys in SECSH format(ssh-rsa, base64 encoded): mianapmplsfw01
%SSH: Failed to encode IOS ASN.1 to SECSH format

xxxx#show running-config | i ssh
ip ssh rsa keypair-name mianapmplsfw01
ip ssh logging events
ip ssh version 2
ip ssh dh min size 2048
ip ssh server algorithm mac hmac-sha1
ip ssh server algorithm encryption aes256-ctr
ip ssh server algorithm publickey ssh-rsa
transport input ssh
transport input telnet ssh
transport input telnet ssh

[Leo Laohoo]

Hmmmm ... I wonder if this isn't FN - 70489 (PKI Self-Signed Certificate Expiration in Cisco IOS and Cisco IOS XE Software).