SSH driver can't negotiate legacy Cisco KEX (diffie-hellman-group1-sha1) — make the libssh2 algorithm set configurable

[UWillC]

Running the O-Node against physical Cisco gear, devices on older IOS are unreachable at key exchange:

[Cisco] SSH handshake failed: Unable to exchange encryption keys (192.168.2.23:22)

IOS 12.2(55)SE (Catalyst 2960/3560) and 12.4(15)T9 (1841) offer only diffie-hellman-group1-sha1 and have no ip ssh dh min size command to raise the group. libssh2 1.11.1's default KEX set excludes group1-sha1, so there's no overlap. Newer IOS (12.4(24)T6, 15.1) offer group14-sha1 and connect + collect fine.

In a 9-device lab, 6/9 were unreachable purely at KEX, independent of auth/driver.

Ask: could the SSH algorithm preference (KEX / host-key / cipher / MAC) be made configurable per-device or globally — e.g. via libssh2_session_method_pref() (LIBSSH2_METHOD_KEX / HOSTKEY / CRYPT_CS …) exposed through a devices.json field or a flag? OpenSSH lets operators opt back into legacy algorithms (KexAlgorithms +diffie-hellman-group1-sha1, HostKeyAlgorithms +ssh-rsa) for brownfield gear they can't reconfigure. group1-sha1 is weak, but for a lot of still-deployed Cisco equipment it's the only option, and right now those devices can't be observed at all. Happy to test a patch against real hardware.

---

Environment: O-Node @ 604edca, make CISCO=1 FORTIGATE=1 PANOS=1 ASA=1 LINUX=1 (+prod); Ubuntu Server 26.04, gcc 15.2, Go 1.26, libssh2 1.11.1 (libssh2-1t64 1.11.1-1ubuntu0.26.04.1); targets = physical Cisco IOS 12.2(55)SE / 12.4(15)T9 / 12.4(24)T6 / 15.1(2)T1.

[UWillC]

Follow-up — patched and tested against the real hardware. This single change took the lab from 6/9 unreachable to 0/9.

Confirmed the root cause and a minimal fix. diffie-hellman-group1-sha1 is still compiled into libssh2 1.11.1 — it's just excluded from the library's default KEX preference list. So no libssh2 rebuild is needed; it only has to be re-selected via libssh2_session_method_pref().

What I changed (one line, in src/drivers/driver_cisco.c, the cisco_connect() KEX list) — appended group1-sha1 as the lowest-priority fallback:

    libssh2_session_method_pref(conn->session, LIBSSH2_METHOD_KEX,
        "ecdh-sha2-nistp256,"
        ...
        "diffie-hellman-group-exchange-sha1,"
        "diffie-hellman-group1-sha1");   /* legacy fallback */

Lowest priority matters: modern devices still negotiate group14/ecdh exactly as before — only peers that offer nothing else fall through to group1-sha1.

Results against physical gear (9-device lab):

• 6/9 → reachable: SW1/2/3 (12.2(55)SE) and R1/2/3 (12.4(15)T9) now complete KEX. Observable set went 3/9 → 9/9, no device-side change. (These can't move device-side anyway — no ip ssh dh min size on those trains, and the 1841s are DRAM-capped at 12.4(15)T.)
• Integrity unaffected: every one of the 9 collected show version observations is HMAC-valid, and a 1-bit tamper on both a router and a switch still flips to INVALID. The weak transport KEX doesn't weaken the signed observation — as expected, since the HMAC is over the payload, not derived from the SSH session.

Suggestion on the shape of the fix: make it opt-in, not default-on. A global default re-enable of group1-sha1 would quietly widen the SSH downgrade surface for greenfield deployments. Two clean options:

1. A build flag — make … LEGACY_KEX=1 — gating the legacy entries in the driver KEX lists; or
2. A per-device devices.json field (e.g. "legacy_kex": true) for surgical opt-in on the brownfield boxes that need it.

Happy to send a PR against 604edca for whichever shape you prefer (I'd lean toward the build flag for simplicity, or the per-device field if you want it scoped tighter).