Unable to Authenticate to RHEL 8 Servers

Products

• CA Privileged Access Manager (PAM)

Issue/Introduction

Seeing the below issue with authenticating to RHEL 8 servers but all cipher's and hashes that are available are being used currently. 

Error:

Couldn't agree either on kex algorithm (our: 'diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,ecdh-sha2-nistp521,ecdh-sha2-nistp256,ecdh-sha2-nistp384', peer: 'ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512') or host key algorithm (our: 'ssh-rsa', peer: 'rsa-sha2-512,rsa-sha2-256,ecdsa-sha2-nistp256')

 

Need to get this updated or fixed so we can authenticate properly with RHEL 8 servers. 

Looks like these are the ones not available and when i try to add them it says not valid. 

diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512

Please advise ASAP. 

Environment

Release : 3.4

Component : PRIVILEGED ACCESS MANAGEMENT

Cause

The initial problem was with the default Cryptography selections in PAM not being compatible with the target server Cryptography settings. But even after addressing that the SSH access method did not work with the RHEL 8 servers.

Resolution

The initial problem was a mismatch between the server key algorithms supported by PAM and the target device. It was resolved by customizing the Server Host Key list on the Configuration > Security > Cryptography > SSH Mindterm page, see documentation page Configure SSH Cipher Suites. After that the connection still had a problem, and we found that the older mindterm version in PAM 3.4.4 was incompatible with the target SSH server. PAM 3.4.6 comes with a newer mindterm version, and upgrade to 3.4.6 resolved this second problem. As of January 2022 the upcoming 4.0.2 maintenance release will include the same mindterm version as 3.4.6.