Observed error while trying to ssh to the device via putty, this article explains the reason of the error and resolution steps to resolve the error.

This error can be seen if there is a mismatch on the cipher key which configured on the device and the cipher key that is used by putty for connection is different.

" couldn't agree a client-to-server cipher (available: [email protected] [email protected]) "

When excluding the chacha20-poly1305 cipher from SSH to remediate the vulnerability caused by CVE-2023-48795.

Following command lists the ciphers that can be included for the ssh connection, in which we can exclude the particular ciphers which are affecting the device and include the other necessary ciphers:

{master:0}[edit]

root@s10-40# set system services ssh ciphers ?

Possible completions:

 3des-cbc       Triple DES in CBC mode

 [          Open a set of values

 aes128-cbc      128-bit AES with Cipher Block Chaining

 aes128-ctr      128-bit AES with Counter Mode

 [email protected] 128-bit AES with Galois/Counter Mode

 aes192-cbc      192-bit AES with Cipher Block Chaining

 aes192-ctr      192-bit AES with Counter Mode

 aes256-cbc      256-bit AES with Cipher Block Chaining

 aes256-ctr      256-bit AES with Counter Mode

 [email protected] 256-bit AES with Galois/Counter Mode

 arcfour       128-bit RC4 with Cipher Block Chaining

 arcfour128      128-bit RC4 with Cipher Block Chaining

 arcfour256      256-bit RC4 with Cipher Block Chaining

 blowfish-cbc     128-bit Blowfish with Cipher Block Chaining

 cast128-cbc     128-bit CAST with Cipher Block Chaining

 [email protected] ChaCha20 stream cipher and Poly1305 MAC

The below command is used for configuring cipher keys:

user@junos# set system services ssh ciphers [a b]

Example:  user@junos# set system services ssh ciphers [[email protected] [email protected]]

2024-01 Reference Advisory: Junos OS and Junos OS Evolved: Impact of Terrapin SSH Attack (CVE-2023-48795) (juniper.net)