現象：VMware ESXi 4.1 から ESXi 6.7 へ scp できない...

ESXi 4.1 の環境から ESXi 6.7 に対して scp 行うと エラー。。。

「-oKexAlgorithms=+diffie-hellman-group1-sha1」をつけてみると解決すると記載してあったが
やはり下記のエラーが発生。。。

# scp file.vmdk -oKexAlgorithms=+diffie-hellman-group1-sha1 -r root@xxx.xxx.xxx.xxx:/vmfs/volumes/Vol1/dir
---
WARNING: Ignoring unknown argument '-oKexAlgorithms=+diffie-hellman-group1-sha1'
/bin/dbclient: connection to root@xxx.xxx.xxx.xxx:22 exited: no matching
algo kex
lost connection
---

ためしに ESXi 6.7 から ESXi 4.1 へ scp して file を get しようと試しても下記のエラーがでる。
---
"diffie-hellman-group1-sha1" is not allowed in FIPS mode
FIPS mode incompatible with SSH2 KexAlgorithms '+diffie-hellman-group1-sha1'.
---

色々サイト見て試した結果。下記で scp できたので以下メモ。

＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊
■VMware ESXi 6.7 に SSH ログイン。
＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊

vi /etc/ssh/sshd_config
下記を追記。
---
KexAlgorithms +diffie-hellman-group1-sha1
---

ESXi では、 SSH デーモン？ の restart は必要ないらしい。
そのまま保存すれば、有効になっているみたい。

次は、firewall を false にする

・現在の環境確認
esxcli network firewall get
--
Default Action: DROP
Enabled: true
Loaded: true
--

・false へ
esxcli network firewall set --enabled false

・確認
esxcli network firewall get
--
Default Action: DROP
Enabled: false
Loaded: true
---

fips mode を false にする
esxcli system security fips140 ssh get
---
Enabled: true
---

esxcli system security fips140 ssh set --enable=false

esxcli system security fips140 ssh get
---
Enabled: false
---

＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊
■VMware ESXi 4.0 に SSH ログイン
＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊

# scp file.vmdk root@xxx.xxx.xxx.xxx:/vmfs/volumes/Vol1/dir/

成功！


fairewall と fips mode を true へ戻す方法は下記に記載。


＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊
■fairewall と fips mode を true にする方法
＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊

esxcli network firewall set --enabled true
esxcli network firewall get

esxcli system security fips140 ssh set --enable=true
esxcli system security fips140 ssh get