HP ProCurve SSH – Cannot Connect to Switch After Bruteforce Attack

hp-procurvessh

One of the operators has bruteforced HP ProCurve switch via SSH. I have connected to device via console cable and killed all SSH sessions. However, I can not still to connect to device via SSH. How can I resolve this problem without device reboot? Thank you.

[SSH] Logged in (password)

[SSH] ERROR: Received disconnect from 172.31.0.1 port 22:11:
Sorry, the maximum number of sessions are active.  Try again later.



[SSH] INFO: DISCONNECT

Best Answer

Change SSH port to eg. 2222. Not 100% sure, but probably all current sessions will close/drop.

SSH key-based authentication can be leveraged to eliminate password brute force attempts. So that won't happen anymore, problem solved.

Related Solutions

Cisco Juniper SSH – Cisco Can’t Connect to Juniper Device via SSH – Invalid Modulus Length

This is definitely an issue with your DH key size.

Try this:

cisco886va(config)#ip ssh dh min size 4096

Cisco SSH – Authenticate SSH Key via Cisco ACS (TACACS+)

It looks like, "No". There's nothing specific in TACACS+ to transport a certificate exchange, however an ASCII data payload could suffice. (the RFC is a decade old) The real question is if ACS has any method to handle it? And that also appears to be "no". The only mention I can find to PKI or certificate based authentication is for EAP-TLS, which is not what you want.

Update

I found a single reference in IOS-XR documents:

Note The preferred method of authentication would be as stated in the SSH RFC. The RSA based authentication support is only for local authentication, and not for TACACS/RADIUS servers.

Best Answer

Related Solutions

Cisco Juniper SSH – Cisco Can’t Connect to Juniper Device via SSH – Invalid Modulus Length

Cisco SSH – Authenticate SSH Key via Cisco ACS (TACACS+)

Related Topic