Newer OpenSSH clients are dropping support for ssh-rsa-cert-v01
#10918
Comments
|
Same problem/fix on Ubuntu Jammy |
|
Just encountered this too (same errors) with:
It worked when I added Currently wondering, how I can actually use that workaround from my CI pipeline, as /opt/machine-id is mounted ro (I could mount it rw for now, until this is fixed). Maybe a config setting for tbot would be good, so one can add more options to the first ...
destinations
- directory: ...
configs:
- ssh_client:
additional_options:
- "PubkeyAcceptedKeyTypes [email protected]" |
|
@frozenice AFAIK the machine ID config block is the same every time it’s generated, so you could potentially take a copy of the file, make edits and then mount it as a secret/similar to use the edited version rather than the one in the output directory for now. |
|
Yes, the immediate problem here is that they've dropped support for known-insecure key signing algorithms in favor of sha2 variants, but the broader problem is that RSA in general is obsolete. While for the time being attacks on correctly-implemented RSA are still mostly theoretical (for anyone without a quantum computer, anyway, so for maybe another 3 years), it would be good to have support for more up-to-date algorithms, specifically ed25519, before some future update to OpenSSH drops RSA entirely. |
|
Just wanted to +1. Encountering the same issue on Pop!_OS (based on Ubuntu Jammy). Suggested workaround fixes it |
|
Running into this issue on MacOS Ventura swell. Workaround is sadly not working |
|
I also ran into this issue on Ubuntu 22.04. The workaround above didn't exactly work but adding the following lines to my |
@tbenz9 You should add these lines to your ssh config, not sshd. Your local ssh config should be located in |
|
|
For macOS Ventura you need to edit the file : /private/etc/ssh/ssh_config and add the following lines in |
This worked like a charm. Thanks! |
After upgrading MacOSX to Ventura, I was suddenly unable into ssh to my RSA SSHD servers. I ran your fix to allow me to connect:
Sure, this is better, but it still doesn't honor my id_rsa file. :-/ It still requires a password (which I do NOT have configured on the SSH server for security reasons). So then I also had to run this:
And then everything suddenly started working perfectly again: Sure, I realize that RSA isn't as secure, but upgrading the SSHD server on this device is not an option for me. |
This should only be added to |
|
Can confirm workaround works if you include the following in |
|
But this is not really resolved! Has it? |
|
@fghamsary it should have been resolved, see #15149 (comment) |
We already have later version than 12 and it is not the case. The ticket was that teleport doesn't use standard SSH clients now and use their own fork version, but the connection created is still with RSA-Cert which is not secure anymore! Here is the connection to our proxy: |
This is a misunderstanding. RSA keys themselves are secure, but connecting with RSA keys using a SHA1 hash signing algorithm is not. See the "Imminent deprecation notice" section of the OpenSSH 8.7 release notes for clarity:
Teleport now uses
|
and others
Description
What happened:
Fedora 35 bundles OpenSSH 8.7 and the default system crypto policy has been changed to remove
ssh-rsaandssh-rsa-cert-v01from the approved list ofPubKeyAcceptedAlgorithms:This breaks
sshconnectivity to Teleport clusters when usingtsh configwith an auto-generated config file:Expanding the
ProxyCommandout to runsshmanually and using-v, we can see that the underlying error is actuallyno mutual signature algorithm:Workaround
The current workaround is to add these two lines to the first section of the generated
~/.ssh/configfile:On Fedora, you can also run
sudo update-crypto-policies --set LEGACYto switch back to the older crypto policies which still trustssh-rsa-cert-v01andssh-rsa.What you expected to happen: Connectivity should work out of the box. Either Teleport should upgrade to a newer SSH certificate format, or automatically add the
PubkeyAcceptedKeyTypesline to generated configs withtsh config.Reproduction Steps
Run above steps on a Fedora 35 machine.
Server Details
teleport version):Teleport v8.3.4 git:v8.3.4-0-g010bea1 go1.17.3/etc/os-release): Fedora 35Client Details
tsh version):Teleport v8.3.4 git:v8.3.4-0-g010bea1 go1.17.3The text was updated successfully, but these errors were encountered: