Hi,

Thanks for the rapid response.  Unfortunately Cisco seem to have AGAIN messed up my login rights, and I can't get into the bug toolkit (was working 2 weeks ago )

Are any workarounds listed for this?  Have found some info about using named certificates instead, but how do you then tell the SSH process to use the named cert?  the ip ssh rsa command is missing on this IOS.

Also what is the recommeded IOS to upgrade to?  This one was only just installed on the 6500's a week ago as recommended by out support company :-/

Thanks,

Nick

We too are seeing this bug. According to the Bug info it's fixed in the following releases.

Fixed-In
12.2(33.5.47)SXH
12.2(32.8.11)SX311
12.2(32.8.11)XJC273.31
12.2(33)SXH6
12.2(32.8.1)YCA273.35                                                          

It's also working in 12.2(33)SXI2a.

Thank you a lot, I had the exact same problem and got it working again with the workaround described in the BugID.

As a side-note, the only thing I did before hitting the bug was setting ip domain-name again. We changed the DNS server addresses and I figured while I changed that by script on every device I'd put the ip domain-name in again just to ensure all devices had the correct domain name. Note it was the EXACTLY SAME domain name in the case of the 6500s. As example I set the domain-name from "mydomain.com" to "mydomain.com".

PS: What a ¢|§¦@#¦#@ implementation

Greetings

Rufer

Hi,

Thanks for the thread bump - it reminded me to look at this again - I have a new Cisco.com login so was finally able to see the bugtracker post, and had this fixed in a few minutes.

For anyone else stumbling upon this thread here's what you do to fix it.

The bug relates to the SSH process cutting off a character from the the end of the key name of automatically generated keys.

1) Find out what your current key is called

sh crypto key mypubkey rsa | inc name

Find the line that is simply hostname.domain.com - that's your key name (e.g. 6509_1.fred.co.uk)

2) enable ssh debugging and enable logging to your telnet session

debug ip ssh

term mon

3) Generate a new key with one character missing

crypto key gen rsa gen label 6509_1.fred.co.u mod 1024

You should see the ssh process stop then start

4) zeroise the new key you just generated

crypto key zeroize rsa 6509_1.fred.co.u

You should see the ssh service completely stop

5) generate a new named cert, e.g. ssh-key

crypto key gen rsa gen label ssh-key mod 1024

You should then see the ssh service start and you should now be able to connect.

6) make sure you can connect OK, then remove telnet as a valid input transport.

line vty 0 15

transport input ssh

Remember to disable the debug

u all

I hope this helps someone!

Cheers,

Nick