交换机修改公钥算法，禁用rsA.和dsA后，crt不发登录设备
- 0关注
- 0收藏，52浏览
问题描述：
我司交换机默认的算法如下：
Key exchange algorithms: ecdh-sha2-nistp256 ecdh-sha2-nistp384 dh-group-exchange-sha1 dh-group14-sha1 dh-group1-sha1
Public key algorithms: x509v3-ecdsa-sha2-nistp256 x509v3-ecdsa-sha2-nistp384 ecdsa-sha2-nistp256 ecdsa-sha2-nistp384 rsa dsa
Encryption algorithms: aes128-ctr aes192-ctr aes256-ctr aes128-gcm aes256-gcm aes128-cbc 3des-cbc aes256-cbc des-cbc
MAC algorithms: sha2-256 sha2-512 sha1 md5 sha1-96 md5-96
客户处将禁用公钥算法里的RSA和dsa，但是禁用后，出现crt无法ssh远程登录设备的问题，通过其他交换机远程提示秘钥不匹配的提示，但是吧另外一台网络设备也禁用公钥算法中的RSA和DSA仍然提示秘钥不匹配，这种问题要使CRT和其他交换机也可以远程登录要怎么操作。
组网及组网描述：
m.163.com/news/rec/YDJ0477U9IO31XWW.html
m.163.com/news/rec/YDJ0967U9IO2UWZY.html
m.163.com/news/rec/YDJ0877U9IO2KXZY.html
m.163.com/news/rec/YDJ0617U9IO2VXYX.html
m.163.com/news/rec/YDJ0787U9IO2QWWW.html
m.163.com/news/rec/YDJ0057U9IO2HWXW.html
m.163.com/news/rec/YDJ1267U9IO2PYWZ.html
m.163.com/news/rec/YDJ0737U9IO1MYWX.html
m.163.com/news/rec/YDJ0227U9IO2TZWY.html
m.163.com/news/rec/YDJ0047U9IO2RYXW.html
m.163.com/news/rec/YDJ0657U9IO1QYYZ.html
m.163.com/news/rec/YDJ1137U9IO2OXXX.html
m.163.com/news/rec/YDJ1157U9IO2NWWX.html
m.163.com/news/rec/YDJ0937U9IO2IYXW.html
m.163.com/news/rec/YDJ1277U9IO1CWZW.html
m.163.com/news/rec/YDJ0627U9IO2CZXZ.html
m.163.com/news/rec/YDJ0047U9IO2GXXZ.html
m.163.com/news/rec/YDJ0847U9IO2FYWY.html
m.163.com/news/rec/YDJ0147U9IO2DWZY.html
m.163.com/news/rec/YDJ0327U9IO29WZX.html
m.163.com/news/rec/YDJ0147U9IO2AXZZ.html
m.163.com/news/rec/YDJ0717U9IO2EXWZ.html
m.163.com/news/rec/YDJ0487U9IO2BYZW.html
m.163.com/news/rec/YDJ0687U9IO24ZXZ.html
m.163.com/news/rec/YDJ0827U9IO23ZWY.html
m.163.com/news/rec/YDJ0757U9IO28ZZZ.html
m.163.com/news/rec/YDJ0287U9IO27ZWZ.html
m.163.com/news/rec/YDJ1187U9IO21WWX.html
m.163.com/news/rec/YDJ0667U9IO26XXY.html
m.163.com/news/rec/YDJ0257U9IO22WWW.html
m.163.com/news/rec/YDJ0077U9IO20YYY.html
m.163.com/news/rec/YDJ0647U9IO1UWXX.html
m.163.com/news/rec/YDJ1237U9IO1SXWY.html
m.163.com/news/rec/YDJ0937U9IO1TWZX.html
m.163.com/news/rec/YDJ0217U9IO1RYYX.html
m.163.com/news/rec/YDJ1137U9IO1VWXY.html
m.163.com/news/rec/YDJ0107U9IO1NXZZ.html
m.163.com/news/rec/YDJ0357U9IO1LXWX.html
m.163.com/news/rec/YDJ0267U9IO1KYZY.html
m.163.com/news/rec/YDJ0767U9IO1PZYX.html
m.163.com/news/rec/YDJ0777U9IO1FWZY.html
m.163.com/news/rec/YDJ0187U9IO1OZZY.html
m.163.com/news/rec/YDJ0087U9IO1JWZZ.html
m.163.com/news/rec/YDJ0627U9IO1GYZY.html
m.163.com/news/rec/YDJ0507U9IO1IYYY.html
m.163.com/news/rec/YDJ1057U9IO1HYYY.html
m.163.com/news/rec/YDJ0327U9IO1EZXW.html
m.163.com/news/rec/YDJ1007U9IO1DYYX.html
m.163.com/news/rec/YDJ0537U9IO1BWXZ.html
m.163.com/news/rec/YDJ0617U9INUOZZW.html
m.163.com/news/rec/YDJ0937U9INVNYYY.html
m.163.com/news/rec/YDJ0247U9IO1AYXZ.html
m.163.com/news/rec/YDJ0277U9IO16XWX.html
m.163.com/news/rec/YDJ0377U9IO17ZWX.html
m.163.com/news/rec/YDJ0207U9IO19XXX.html
m.163.com/news/rec/YDJ0977U9IO15WZY.html
m.163.com/news/rec/YDJ0907U9IO18YXX.html
m.163.com/news/rec/YDJ0617U9IO0OWXX.html
m.163.com/news/rec/YDJ0937U9IO13YYY.html
m.163.com/news/rec/YDJ0477U9IO0QZWZ.html
m.163.com/news/rec/YDJ0787U9IO0LYYZ.html
m.163.com/news/rec/YDJ0877U9IO12WXZ.html
m.163.com/news/rec/YDJ0357U9INVTYZZ.html
m.163.com/news/rec/YDJ0967U9IO0NXXW.html
m.163.com/news/rec/YDJ0227U9IO0MZWY.html
m.163.com/news/rec/YDJ1137U9IO0JYWW.html
m.163.com/news/rec/YDJ0877U9IO0HWXX.html
m.163.com/news/rec/YDJ1157U9IO0FYWW.html
m.163.com/news/rec/YDJ0627U9IO07XZZ.html
m.163.com/news/rec/YDJ0057U9IO09ZXZ.html
m.163.com/news/rec/YDJ0007U9IO0EYWZ.html
m.163.com/news/rec/YDJ0047U9IO0DZZZ.html
m.163.com/news/rec/YDJ0937U9IO0GXXY.html
m.163.com/news/rec/YDJ1267U9IO0BXYW.html
m.163.com/news/rec/YDJ0847U9IO0CYZY.html
m.163.com/news/rec/YDJ0717U9IO03ZWX.html
m.163.com/news/rec/YDJ0327U9IO0AYZX.html
m.163.com/news/rec/YDJ0487U9IO04ZZZ.html
m.163.com/news/rec/YDJ0667U9IO06WZZ.html
m.163.com/news/rec/YDJ0147U9IO08YWW.html
m.163.com/news/rec/YDJ0647U9INVMXYW.html
m.163.com/news/rec/YDJ0757U9IO05WZZ.html
m.163.com/news/rec/YDJ0687U9IO02ZXW.html
m.163.com/news/rec/YDJ0827U9IO01XYZ.html
m.163.com/news/rec/YDJ0847U9INU7XWZ.html
m.163.com/news/rec/YDJ0147U9INVGXWX.html
m.163.com/news/rec/YDJ0257U9IO00XZZ.html
m.163.com/news/rec/YDJ0277U9INV1WWZ.html
m.163.com/news/rec/YDJ1137U9INVQYXW.html
m.163.com/news/rec/YDJ0077U9INVVYZZ.html
m.163.com/news/rec/YDJ0107U9INVUWYY.html
m.163.com/news/rec/YDJ1187U9INVPZWX.html
m.163.com/news/rec/YDJ1237U9INVKXYW.html
m.163.com/news/rec/YDJ0657U9INVOWWY.html
m.163.com/news/rec/YDJ0217U9INVRYYW.html
m.163.com/news/rec/YDJ0187U9INVSWZX.html
m.163.com/news/rec/YDJ0737U9INVJXXW.html
m.163.com/news/rec/YDJ0767U9INVLXZY.html
m.163.com/news/rec/YDJ0267U9INVIYWW.html
m.163.com/news/rec/YDJ0777U9INVEYZX.html
m.163.com/news/rec/YDJ0507U9INVDWWX.html
m.163.com/news/rec/YDJ0627U9INVHYWZ.html
m.163.com/news/rec/YDJ0087U9INVCWYW.html
m.163.com/news/rec/YDJ0047U9INVFXYY.html
m.163.com/news/rec/YDJ1277U9INV9XZY.html
m.163.com/news/rec/YDJ0207U9INVBWWY.html
m.163.com/news/rec/YDJ1057U9INV2ZWW.html
m.163.com/news/rec/YDJ0537U9INV8XXZ.html
m.163.com/news/rec/YDJ0247U9INV3ZYY.html
m.163.com/news/rec/YDJ0327U9INVAYYY.html
m.163.com/news/rec/YDJ0377U9INV6YWX.html
m.163.com/news/rec/YDJ1007U9INV5WZZ.html
m.163.com/news/rec/YDJ0907U9INV7ZYZ.html
m.163.com/news/rec/YDJ0047U9INV4XXW.html
m.163.com/news/rec/YDJ0287U9INUVYXY.html
m.163.com/news/rec/YDJ0977U9INV0YXY.html
m.163.com/news/rec/YDJ0937U9INUTZWX.html
m.163.com/news/rec/YDJ0477U9INUPYZZ.html
m.163.com/news/rec/YDJ0007U9INUGYXZ.html
m.163.com/news/rec/YDJ0717U9INTUZYW.html
m.163.com/news/rec/YDJ0877U9INUUZZZ.html
m.163.com/news/rec/YDJ0967U9INUEZXY.html
m.163.com/news/rec/YDJ1137U9INUKWZW.html
m.163.com/news/rec/YDJ0227U9INUMWXZ.html
m.163.com/news/rec/YDJ0877U9INUIXXX.html
m.163.com/news/rec/YDJ0937U9INUHZWX.html
m.163.com/news/rec/YDJ1157U9INUFYXY.html
m.163.com/news/rec/YDJ0667U9INU9XWX.html
m.163.com/news/rec/YDJ0327U9INUBXYW.html
m.163.com/news/rec/YDJ1267U9INUCXYY.html
m.163.com/news/rec/YDJ0627U9INU8ZWW.html
m.163.com/news/rec/YDJ0757U9INUAWXY.html
m.163.com/news/rec/YDJ0147U9INU6WXY.html
m.163.com/news/rec/YDJ0257U9INU2ZXZ.html
m.163.com/news/rec/YDJ0687U9INU5YZW.html
m.163.com/news/rec/YDJ0077U9INU1ZZY.html
m.163.com/news/rec/YDJ0057U9INU0YYW.html
m.163.com/news/rec/YDJ0647U9INTPYYZ.html
m.163.com/news/rec/YDJ0487U9INU3ZZY.html
m.163.com/news/rec/YDJ0107U9INTRXYW.html
m.163.com/news/rec/YDJ0187U9INU4ZWX.html
m.163.com/news/rec/YDJ0147U9INTJXYY.html
m.163.com/news/rec/YDJ0767U9INTNXWW.html
m.163.com/news/rec/YDJ0787U9INTTWWX.html
m.163.com/news/rec/YDJ0627U9INTLWXY.html
m.163.com/news/rec/YDJ1137U9INTFXZY.html
m.163.com/news/rec/YDJ0357U9INTMYWX.html
m.163.com/news/rec/YDJ1187U9INTVZWZ.html
m.163.com/news/rec/YDJ0937U9INTOWZX.html
m.163.com/news/rec/YDJ0657U9INTQYXW.html
m.163.com/news/rec/YDJ1237U9INTSXWY.html
m.163.com/news/rec/YDJ0737U9INTKWXX.html
m.163.com/news/rec/YDJ0507U9INTIXXW.html
m.163.com/news/rec/YDJ0207U9INTEXZY.html
m.163.com/news/rec/YDJ0217U9INTHZWW.html
m.163.com/news/rec/YDJ0537U9INTDZYW.html
m.163.com/news/rec/YDJ0377U9INSTWWY.html
m.163.com/news/rec/YDJ0277U9INT4ZZX.html
m.163.com/news/rec/YDJ1277U9INTBWXZ.html
m.163.com/news/rec/YDJ0267U9INTGYXW.html
m.163.com/news/rec/YDJ0047U9INT8ZYW.html
m.163.com/news/rec/YDJ0047U9INTAWWZ.html
m.163.com/news/rec/YDJ0087U9INTCZZY.html
m.163.com/news/rec/YDJ0047U9INT2ZXW.html
m.163.com/news/rec/YDJ0247U9INT9ZXW.html
m.163.com/news/rec/YDJ0327U9INT7XXW.html
m.163.com/news/rec/YDJ1007U9INT6YXW.html
m.163.com/news/rec/YDJ0287U9INT0YZW.html
m.163.com/news/rec/YDJ1057U9INSSYXW.html
m.163.com/news/rec/YDJ0777U9INT5XZX.html
m.163.com/news/rec/YDJ0937U9INSUZWW.html
m.163.com/news/rec/YDJ0907U9INT3ZXX.html
m.163.com/news/rec/YDJ0877U9INT1XZW.html
m.163.com/news/rec/YDJ0977U9INSVWYZ.html
关键信息缺失：
1. 完整的公钥算法列表。
2. 您执行了哪些具体配置命令来禁用RSA和DSA。
3. 具体现象是SSH客户端无法连接，还是证书（CRT）认证失败？请明确“crt不发登录设备”的具体报错。
排查步骤与命令：
1. 检查当前SSH服务器算法配置：
`display ssh server algorithm`
2. 检查SSH用户认证方式：
`display ssh user-information`
3. 检查SSH连接日志：
`display logbuffer` 或 `terminal monitor` 后尝试登录，查看实时日志。
4. 恢复与验证：
* 如果配置错误导致无法登录，需通过Console口登录恢复。
* 检查公钥算法配置命令，确保至少启用一种客户端支持的算法。例如，启用RSA：`ssh server algorithm public-key rsa`。
请补充完整信息以便精准定位。
要解决禁用 RSA/DSA 公钥算法后 SSH 无法登录的问题，关键在于确保 SSH 客户端主动选择 ECDSA 算法，并且 交换机已正确生成 ECDSA 主机密钥。
一、服务端（交换机）配置
1. 确保已生成 ECDSA 主机密钥
禁用 RSA/DSA 后，交换机必须使用 ECDSA 密钥作为主机身份证明。
检查：
display public-key local ecdsa public如果没有或需要重新生成：
public-key local create ecdsa secp256r1 # 生成256位ECDSA密钥system-view- 2. 配置 SSH 服务器公钥算法（只允许 ECDSA）
system-viewssh2 algorithm public-key ecdsa-sha2-nistp256 ecdsa-sha2-nistp384注意：此命令会覆盖默认的公钥算法列表，确保只有 ECDSA 算法被协商。
3. 确认 SSH 服务已开启并应用新配置
display ssh server status # 查看SSH服务状态display ssh2 algorithm # 确认公钥算法列表已更新若需要，可重启 SSH 服务：undo ssh server enable 后再 ssh server enable。
二、客户端配置
1. SecureCRT 客户端
关键：清除旧的 RSA 主机密钥缓存，并强制使用 ECDSA 算法。
修改会话算法：
右键点击会话 → Properties → SSH2 选项卡：Key Exchange：确保列表包含
ecdh-sha2-nistp256、ecdh-sha2-nistp384，可移除diffie-hellman开头的选项。Authentication：Public Key 部分，选择 Use session public key setting。
Advanced：勾选 Use ECDH key exchange for ECDSA keys（如有此选项）。
保存后重试连接。
2. 另一台交换机作为 SSH 客户端
当从交换机 A SSH 登录到交换机 B 时，需在命令中显式指定使用 ECDSA 主机密钥验证。
在 PuTTY 的 Connection → SSH → Auth 中，确保 Host keys 勾选
ecdsa-sha2-nistp256、ecdsa-sha2-nistp384。在 Connection → SSH → Kex 中，优先选择
ecdh-sha2-nistp256等 ECDH 算法。删除已保存的旧主机密钥（通过注册表或 PuTTY 的 Host Keys 管理）。
三、验证与排错
1. 检查服务端协商过程
在交换机上开启 SSH 调试信息，观察客户端协商的算法：
ecdsa-sha2-nistp256。2. 确认客户端使用的算法
SecureCRT：连接时会在 Log 窗口显示“The server supports the following host key algorithms: ...”，检查其中是否包含 ECDSA。
交换机客户端：使用
-v参数查看详细调试信息（部分型号支持）。
3. 常见问题
仍报“密钥不匹配”：100% 是因为客户端缓存了旧的 RSA 主机公钥，必须彻底删除。
连接被拒绝：可能是服务端未生成 ECDSA 密钥，或
ssh2 algorithm public-key配置错误（如遗漏 ECDSA 算法）。连接超时：检查网络连通性及 SSH 服务端口（默认 22）。
暂无评论
编辑答案
亲~登录后才可以操作哦!
确定你的邮箱还未认证，请认证邮箱或绑定手机后进行当前操作
举报
×
侵犯我的权益
×
侵犯了我企业的权益
×
- 1. 您举报的内容是什么？（请在邮件中列出您举报的内容和链接地址）
- 2. 您是谁？（身份证明材料，可以是身份证或护照等证件）
- 3. 是哪家企业？（营业执照，单位登记证明等证件）
- 4. 您与该企业的关系是？（您是企业法人或被授权人，需提供企业委托授权书）
抄袭了我的内容
×
原文链接或出处
诽谤我
×
- 1. 您举报的内容以及侵犯了您什么权益？（请在邮件中列出您举报的内容、链接地址，并给出简短的说明）
- 2. 您是谁？（身份证明材料，可以是身份证或护照等证件）
对根叔社区有害的内容
×
不规范转载
×
举报说明
暂无评论