SSH items with kex algorithms mismatch

[markfree]

Zabbix 7.2
OS Oracle Linux 9.6

I have a legacy switch that is monitored by a Zabbix Proxy and has SSH items configured.
However, the SSH items are unable to reach the host due to a mismatch in Kex algorithms.
Here's the error message that Zabbix displays:

Cannot establish SSH session:
kex error :
no match for method kex algos:
server [diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1],
client [curve25519-sha256,[email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512]

I'm unable to connect to the switch from the Proxy terminal either, with basically the same error message.

So, I've added the following configuration to the proxy "/etc/ssh/ssh_config" file.

Host 10.22.200.89
    KexAlgorithms ^diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
    MACs ^hmac-sha1,hmac-sha1-96

Also, the /etc/ssl/openssl.cnf file is configured to allow legacy algorithms.

[ evp_properties ]
rh-allow-sha1-signatures = yes
[provider_sect]
default = default_sect
legacy = legacy_sect
[legacy_sect]
activate = 1

After making this configuration change, I can SSH to the host from the Proxy CLI with my own user.
However, the error remains the same when connecting from Zabbix itself.

As I understand it, the Proxy should handle the SSH connection to the monitored host.
It seems that no matter what SSH configuration I try, it does not affect the Zabbix connection.
So, I'm not sure what the issue is.

Has anyone encountered this issue before?

[Markku]

Indeed, the issue lies in Zabbix's use of "libssh", which is not configurable.

I've tried to enabled pubkey authentication on the switch and added the client (Zabbix) pub key to it, but the same error persists.

You said you tried pubkey auth, but did you try this in the item configuration (linked above):

The following option keys are supported: KexAlgorithms, HostkeyAlgorithms, Ciphers, MACs, PubkeyAcceptedKeyTypes. Option key and value support depends on the SSH library (for example, PubkeyAcceptedKeyTypes is supported only with libssh)

Example in the manual:

ssh.run[KexAlgorithms,,,,"KexAlgorithms=diffie-hellman-group1-sha1;HostkeyAlgorithms=ssh-rsa,ssh-dss,ecdh-sha2-nistp256"]

Markku

[Markku]

I think Zabbix uses libssh, and AFAIK there is no way to externally configure it globally or within Zabbix.

You should be able to patch the Zabbix proxy sources to use older algos (hard to maintain in the long run, yes), or try to use an SSH proxy to connect to the legacy devices.

Maybe also look for an existing ZBXNEXT issue about (= possibility for configuring the SSH settings) or submit a new one in support.zabbix.com.

Markku

[Markku]

Wait, did you look at the SSH item configurations?

https://www.zabbix.com/documentation/current/en/manual/config/items/itemtypes/ssh_checks

Markku

[markfree]

Indeed, the issue lies in Zabbix's use of "libssh", which is not configurable.

I've tried to enabled pubkey authentication on the switch and added the client (Zabbix) pub key to it, but the same error persists.

Rather than recompiling the proxy, I think it would be better to use external scripts.

[Markku]

Indeed, the issue lies in Zabbix's use of "libssh", which is not configurable.

I've tried to enabled pubkey authentication on the switch and added the client (Zabbix) pub key to it, but the same error persists.

You said you tried pubkey auth, but did you try this in the item configuration (linked above):

The following option keys are supported: KexAlgorithms, HostkeyAlgorithms, Ciphers, MACs, PubkeyAcceptedKeyTypes. Option key and value support depends on the SSH library (for example, PubkeyAcceptedKeyTypes is supported only with libssh)

Example in the manual:

ssh.run[KexAlgorithms,,,,"KexAlgorithms=diffie-hellman-group1-sha1;HostkeyAlgorithms=ssh-rsa,ssh-dss,ecdh-sha2-nistp256"]

Markku

[markfree]

That was it.

I had completely overlooked the SSH options parameter.
After adding the correct options, the item worked as intended.

I knew I could count on you guys.
Thank you.