After updating multiple Sophos Firewalls to Version 9.403 the SSH Sensors aren't working anymore. (Sophos Change log: NUTM-3813 [Basesystem] Remove SSH weak algorithms)

The SSH Sensor shows "Failed to connect. Please check the SSH log of the target device or try the Compatibility Mode of the sensor's SSH engine ande target s consider updating thystem's operating system. Reason: ssh_connect failed"

The SSH Log on the Firewall says: "fatal: no matching mac found:..."

PRTG is up to date and also tried the Compatibility Mode.


Article Comments

Hi there,

If you enable the "SSH Compatibility Mode", what error message do you get then? What is shown in the log of the device? Are you able to login manually (e.g. via Putty) on the target device via SSH?

Best regards.


Feb, 2017 - Permalink

On SSH Compatibility Mode the Sensor shows "Das Hostsystem kann PRTG's Befehl nicht verarbeiten: "". (Code: PE096)".

Login with Putty is working fine.


Mar, 2017 - Permalink

Hi,

Please activate the "Write sensor result to disk (Filename: "Result of Sensor [ID].txt")" option in the sensor settings and provide us the sensor logs, they are located on the PRTG Core Server or the remote probe under "C:\ProgramData\Paessler\PRTG Network Monitor\Logs(Sensors)".


Mar, 2017 - Permalink

The logs say: 0.06 0.12 0.13 1/287 4855


Mar, 2017 - Permalink

Hi there,

From what sensors did you got this result? Is this the whole log as there have to be at least two files in the folder?


Mar, 2017 - Permalink

Its from the sshloadavgsensor Sensor.

there is a second log Result of Sensor 17828.Data.txt

Data['CheckFlavor'].asString := '1';
Data['DoNotCheckShell'].asString := '';
Data['UsedSha2'].asString := '1';
Data['blockedsens'].asString := '';
Data['canlinux'].asString := '0';
Data['checkfailed'].asString := '0';
Data['command'].asString := 'cat /proc/loadavg';
Data['deviceid'].asString := '14257';
Data['elevation'].asString := '0';
Data['elevationkind'].asString := '';
Data['elevationname'].asString := '';
Data['elevationpass'].asString := '';
Data['fastcount'].asString := '0';
Data['host'].asString := '';
Data['hostv6'].asString := '';
Data['inerror'].asString := '0';
Data['interfacenumber'].asString := '';
Data['inum'].asString := '';
Data['ipversion'].asString := '0';
Data['isexesensor'].asString := '0';
Data['lastmsg'].asString := '#P1';
Data['lastuptime'].asString := '0';
Data['notonpod'].asString := '0';
Data['password'].asString := '***';
Data['port'].asString := '22';
Data['privatekey'].asString := '***';
Data['reboot'].asString := '42795.5297218866';
Data['reqmsginterval'].asString := '60';
Data['resultfile'].asString := 'Result of Sensor 17828.txt';
Data['sensorid'].asString := '17828';
Data['shelltimeout'].asString := '10';
Data['simulate'].asString := '0';
Data['ssh_linuxflavor'].asString := '0';
Data['ssh_linuxshell'].asString := '$SHELL = /bin/bash
 1601 ?        00:00:00 bash

';
Data['sshversion_devicegroup'].asString := '2';
Data['sshversion_sensor'].asString := '0';
Data['timeout'].asString := '60';
Data['tlsexplicit_default'].asString := '';
Data['tlsexplicit_ftp'].asString := '';
Data['tlsexplicit_imap'].asString := '';
Data['tlsexplicit_pop3'].asString := '';
Data['tlsexplicit_port'].asString := '';
Data['tlsexplicit_smtp'].asString := '';
Data['uptimecount'].asString := '0';
Data['usednstime'].asString := '0';
Data['user'].asString := 'loginuser';
Data['writeresult'].asString := '1';

And a third "....17828 (SSHv2).txt"

[INFO][14.03.2017 07:55:08] Opening Connection
[INFO][14.03.2017 07:55:08] Linux Flavor was determined previously
[INFO][14.03.2017 07:55:08] Linux Flavor: Linux
[INFO][14.03.2017 07:55:08] Shell: $SHELL = /bin/bash
 1601 ?        00:00:00 bash


[INFO][14.03.2017 07:55:08] Sending command cat /proc/loadavg
[INFO][14.03.2017 07:55:08] Sending EOF
[INFO][14.03.2017 07:55:08] Reading PaeSSH result
[INFO][14.03.2017 07:55:08] [STDOUT] 0.06 0.12 0.13 1/287 4855


[INFO][14.03.2017 07:55:08] [STDERR] 
[INFO][14.03.2017 07:55:08] Sending exit
[INFO][14.03.2017 07:55:08] Sending EOF

Mar, 2017 - Permalink

Hi there,

Thanks for the logs. The issue still remains and the error message is still(?):

"Das Hostsystem kann PRTG's Befehl nicht verarbeiten: "". (Code: PE096)".

If so, then please add the Load Average sensor anew as the result "0.06 0.12 0.13 1/287 4855" is actually okay. Does this work?

Best regards.


Mar, 2017 - Permalink