Sudden Putty Connection Issue

[djtech2k]

Today I tried to connect to my Asuswrt router via putty and noticed it immediately fails with the "Network error: Software caused connection abort" error message. I have used putty many times over the years with this profile with no issue but now it immediately fails. It is not timing out because its immediate. I can tcp connect to port 22 on the internal IP, so its open. I can use putty to connect with the same settings from another laptop on the same network. The connection to my AC68U is the only putty connection that fails and its only from this laptop.

Any ideas on what the issue could be? IDK if it could be the router but I am a little baffled.

 

[Justinh]

Asus RT-AC68U SSH not responsive after time, reboot not helping.

I have a the Asus 68U and I have a strange problem. I was working with putty on SSH port 22. It was getting slower. Sometime 1 a 2 minutes to get a loginprompt After a while a disconnect. Now I can connect to port 22 but I don't get any prompt to login (I use username + password). Reset did...

www.snbforums.com

 

[djtech2k]

The thing is I can connect to SSH on the router from other clients. Its just not working from putty on this specific laptop, even though I have used it exactly like this for years. Its SO odd.

 

[djtech2k]

After more testing, I have verified that the "problem" laptop can use putty to other SSH servers and it can use other SSH clients to connect to my AC68U. I have also verified that a different laptop can use putty to connect to everything.

So it seems to only be putty running from a specific laptop connecting only to my AC68U. Every other combination works. I have used putty to connect to this router from this laptop using putty for years. I have no idea why it immediately fails now. It doesn't even try to connect.

I also did disable skynet on the router just to make sure it wasn't that and nothing changed, so that's not it.

 

[dave14305]

Are you using a hostname or IP address to connect? Are there any logs on the router end during the connection attempt?

Did you try Windows ssh.exe client as a sanity check?

 

[Digilog]

SSH requires the time to be correct. Check the laptop time/date.
otherwise, the session cache is corrupt on the client machine and you have to restart the computer to flush the cache.

 

[ColinTaylor]

SSH requires the time to be correct.

This is not true.

 

[djtech2k]

My laptop time is accurate. I can use the SSH command from the same laptop and connect the the Asus just fine. Its only putty being run from this laptop trying to connect to this Asus. Like I said, it worked fine for years before this. I have uninstalled/reinstalled putty and deleted the registry keys under HKCU but nothing has worked.

I did do a packet trace with wireshark and I do see the RST/Reset in the trace. It looks like its from source of the router and destination of my laptop, going from port 22 to port 51821. It happens immediately when I click connect in putty.

Its just so odd.

 

[djtech2k]

Are you using a hostname or IP address to connect? Are there any logs on the router end during the connection attempt?

Did you try Windows ssh.exe client as a sanity check?

Using internal IP address and yes SSH will connect from the same laptop. Putty will connect from this laptop to every other SSH server I try. And other laptops can use putty to SSH to this Asus.

 

[bennor]

If you continue to have trouble on the one PC, try the portable version of putty rather than the installer (MSI) version of putty as a troubleshooting step.

Download PuTTY: latest release (0.82)

www.chiark.greenend.org.uk

It may help if you provide more information about that one PC that is having an issue. What is it's OS? How is it's network setup/configured (wifi, ethernet)? Is the PC running any third party firewall or security software? Temporarily disable that firewall or security software as a troubleshooting step.

For what ever reason Norton 360 installed on one laptop flagged the latest version of putty.exe (0.82) as malware and quarantined it.

 

[Digilog]

I did do a packet trace with wireshark and I do see the RST/Reset in the trace. It looks like its from source of the router and destination of my laptop, going from port 22 to port 51821. It happens immediately when I click connect in putty.

then the router has refused connection and looks like it assumes a hostile client.
Try rebooting the router.

 

[djtech2k]

All my laptops are running Windows 11. I have allowed putty thru the windows firewall, even though it always worked before.

I have rebooted the router and my laptop.

I have putty v0.82 installed but I have tried just the downloaded exe, and I tried the latest dev version of putty exe. All same results.

Like I said, I can use putty on this laptop to connect to anything else just fine, and I can use the OpenSSH client to connect to the Asus just fine. Its so odd.

 

[Digilog]

All my laptops are running Windows 11. I have allowed putty thru the windows firewall, even though it always worked before.

I have rebooted the router and my laptop.

I have putty v0.82 installed but I have tried just the downloaded exe, and I tried the latest dev version of putty exe. All same results.

Like I said, I can use putty on this laptop to connect to anything else just fine, and I can use the OpenSSH client to connect to the Asus just fine. Its so odd.

well your wireshark revealed what happened. But if your router has an SSH log, I would turn it on if its not on and look at why its refusing the connection. Because there are not many things that can prevent it from connecting and a port redirect is the commonly programmed weak sauce defense against a DDOS attack on a router. If the laptop is able to SSH into anything else (other than itself), then the laptop has no issues. Make sure the user/password is correct.

 

[Digilog]

This is not true.

I looked it up, time is only needed with SSL authentication. But not with user/password. But the thread starter needs to look at the logs in the router into why the laptop is rejected.

 

[djtech2k]

I am happy to look at the logs but not sure where to find it. It cannot be a user/password thing because putty fails as soon as I click connect. There is no name/password at that point.

The same laptop that putty fails can connect to the same Asus router with other SSH tools and a different laptop can connect with putty to the same Asus router.

 

[djtech2k]

Here is a quick diagram that helps explain what works and what doesn't. The words can be confusing.

 

[djtech2k]

OK I looked in the syslog.log file right after I tried to connect. Here is what I found:

Dec 4 13:48:06 dropbear[14732]: Child connection from 192.168.x.x:53823
Dec 4 13:48:06 dropbear[14732]: Exit before auth from <192.168.x.x:53823>: No matching algo kex

Any ideas on what this could be? Does that last line have something to do with key exchange? I have no idea why that would happen because nothing has changed. Also, I have deleted putty and the registry entries so the keys would be gone in that scenario.

 

[Digilog]

I am happy to look at the logs but not sure where to find it. It cannot be a user/password thing because putty fails as soon as I click connect. There is no name/password at that point.

The same laptop that putty fails can connect to the same Asus router with other SSH tools and a different laptop can connect with putty to the same Asus router.

In the router its under advanced settings and near the bottom of the list.

need to find out if there is an authentication setting wrong, I doubt that the router is intelligent enough to block discretely the user-agent (putty).

 

[djtech2k]

In the router its under advanced settings and near the bottom of the list.



need to find out if there is an authentication setting wrong, I doubt that the router is intelligent enough to block discretely the user-agent (putty).

My last posts show the data since I found it in SSH.

Dec 4 13:48:06 dropbear[14732]: Child connection from 192.168.x.x:53823
Dec 4 13:48:06 dropbear[14732]: Exit before auth from <192.168.x.x:53823>: No matching algo kex

 

[Digilog]

OK I looked in the syslog.log file right after I tried to connect. Here is what I found:

Dec 4 13:48:06 dropbear[14732]: Child connection from 192.168.x.x:53823
Dec 4 13:48:06 dropbear[14732]: Exit before auth from <192.168.x.x:53823>: No matching algo kex

Any ideas on what this could be? Does that last line have something to do with key exchange? I have no idea why that would happen because nothing has changed. Also, I have deleted putty and the registry entries so the keys would be gone in that scenario.

From my development SSH debug notes: SHA1 is being rejected because the SHA1 algorithm in the old client software is not recognized by the new server. Is this the latest version of Putty?