RCA-2026-03-16-002: Fix Applied

Resolution

Immediate Fix (Command Line Override)

/usr/bin/ssh -o PasswordAuthentication=yes \
    -o PreferredAuthentications=keyboard-interactive,password \
    -o PubkeyAuthentication=no \
    admin@10.50.1.21

Permanent Fix (Config Restructure)

Move all device-specific exceptions BEFORE Host *:

# ═══════════════════════════════════════════════════════════════════════════════
# EXCEPTIONS - Must come BEFORE Host *
# ═══════════════════════════════════════════════════════════════════════════════

Host ssh.dev.azure.com
    # Azure DevOps exception
    ...

Host ise-01 ise-02 ise-lab          # <-- MOVE HERE
    User admin
    PubkeyAuthentication no
    PasswordAuthentication yes
    ...

Host cisco-* switch-* router-*      # <-- MOVE HERE
    User admin
    PubkeyAuthentication no
    PasswordAuthentication yes
    ...

# ═══════════════════════════════════════════════════════════════════════════════
# GLOBAL DEFAULTS - Must come AFTER exceptions
# ═══════════════════════════════════════════════════════════════════════════════

Host *
    PasswordAuthentication no
    PreferredAuthentications publickey
    ...

# ═══════════════════════════════════════════════════════════════════════════════
# REGULAR HOSTS - These inherit from Host * but can override
# ═══════════════════════════════════════════════════════════════════════════════

Host kvm-01
    HostName 10.50.1.110
    # Inherits PasswordAuthentication no from Host *

The MODEL: SSH Config Structure

# 1. EXCEPTIONS (specific overrides) - FIRST
Host legacy-device
    Ciphers +aes256-cbc
    KexAlgorithms +diffie-hellman-group1-sha1

Host cisco-ise-*
    PubkeyAuthentication no
    PasswordAuthentication yes

# 2. GLOBAL DEFAULTS - MIDDLE
Host *
    PasswordAuthentication no
    PreferredAuthentications publickey

# 3. HOST DEFINITIONS - LAST (inherit from Host *)
Host server-01
    HostName 10.0.0.1