ASR96: SECURITY-SSHD-6-INFO_REKEY Server initiated time rekey for session

[senpai]

I'm currently seeing the following log messages. only seen after ios-xr upgrade from 5.3.2 to 6.4.2. The session_rekey_count seems to be incrementing over time.

SSHD_[65822]: %SECURITY-SSHD-6-INFO_REKEY : Server initiated time rekey for session 1 , session_rekey_count = 1
SSHD_[65942]: %SECURITY-SSHD-6-INFO_REKEY : Server initiated time rekey for session 2 , session_rekey_count = 1
SSHD_[65822]: %SECURITY-SSHD-6-INFO_REKEY : Server initiated time rekey for session 1 , session_rekey_count = 2
SSHD_[65942]: %SECURITY-SSHD-6-INFO_REKEY : Server initiated time rekey for session 2 , session_rekey_count = 2
....
SSHD_[65942]: %SECURITY-SSHD-6-INFO_REKEY : Server initiated time rekey for session 2 , session_rekey_count = 16
SSHD_[65822]: %SECURITY-SSHD-6-INFO_REKEY : Server initiated time rekey for session 1 , session_rekey_count = 17
SSHD_[65942]: %SECURITY-SSHD-6-INFO_REKEY : Server initiated time rekey for session 2 , session_rekey_count = 17
SSHD_[65822]: %SECURITY-SSHD-6-INFO_REKEY : Server initiated time rekey for session 1 , session_rekey_count = 18
SSHD_[65942]: %SECURITY-SSHD-6-INFO_REKEY : Server initiated time rekey for session 2 , session_rekey_count = 18
SSHD_[65822]: %SECURITY-SSHD-6-INFO_REKEY : Server initiated time rekey for session 1 , session_rekey_count = 19
SSHD_[65942]: %SECURITY-SSHD-6-INFO_REKEY : Server initiated time rekey for session 2 , session_rekey_count = 19
SSHD_[65822]: %SECURITY-SSHD-6-INFO_REKEY : Server initiated time rekey for session 1 , session_rekey_count = 20

[tkarnani · Accepted solution]

when you upgrade to 6.4.2 it includes a new feature of SSH server to comply with  FIP standards

essentially the key will be refreshed after a certain period of time or after a certain # of bytes

https://www.cisco.com/c/en/us/td/docs/routers/asr9000/software/asr9k-r6-4/system-security/configuration/guide/b-system-security-cg-asr9000-64x/b-system-security-cg-asr9000-64x_chapter_01110.html


https://www.cisco.com/c/en/us/td/docs/routers/asr9000/software/asr9k_r6-1/security/command/reference/b-syssec-cr-asr9k-61x/b-syssec-cr-asr9k-61x_chapter_01010.html#wp3363813337

ssh server rekey-time

To configure rekey of the ssh server key based on time. Use the no form of this command to remove the rekey interval.

ssh server rekey-time time in minutes

no ssh server rekey-time

Syntax Description

rekey-time time in minutes

Specifies the rekey-time interval in minutes. The range is between 30 to 1440 minutes. Note    If no time interval is specified, the default interval is considered to be 30 minutes.

ssh server rekey-volume

To configure a volume-based rekey threshold for an SSH session. Use the no form of this command to remove the volume-based rekey threshold.

ssh server rekey-volume data in megabytes

no ssh server rekey-volume

Syntax Description

rekey-volume data in megabytes

Specifies the volume-based rekey threshold in megabytes. The range is between 1024 to 4095 megabytes. Note    If no volume threshold is specified, the default size is considered to be 1024 MB.