Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Bad configuration option: pubkeyacceptedalgorithms #10939

Closed
benarent opened this issue Mar 8, 2022 · 6 comments
Closed

Bad configuration option: pubkeyacceptedalgorithms #10939

benarent opened this issue Mar 8, 2022 · 6 comments
Assignees
@zmb3
Labels
bug machine-id

Comments

@benarent
Copy link
Contributor

benarent commented Mar 8, 2022 •
edited
Loading

Description

What happened:
TODO: Complete bug. Unable to ssh due to bad config option.

root@ip-10-0-0-66:/opt/machine-id# cat ssh_config 

# Begin generated Teleport configuration for teleport-9a.asteroid.earth from tbot config

# Common flags for all teleport-9a.asteroid.earth hosts
Host *.teleport-9a.asteroid.earth teleport-9a.asteroid.earth
    UserKnownHostsFile "/opt/machine-id/known_hosts"
    IdentityFile "/opt/machine-id/key"
    CertificateFile "/opt/machine-id/sshcert"
    HostKeyAlgorithms [email protected]
    PubkeyAcceptedAlgorithms [email protected]

# Flags for all teleport-9a.asteroid.earth hosts except the proxy
Host *.teleport-9a.asteroid.earth !teleport-9a.asteroid.earth
    Port 3022
    ProxyCommand ssh -F /opt/machine-id/ssh_config -l %r -p 3023 teleport-9a.asteroid.earth -s proxy:%h:%[email protected]

# End generated Teleport configuration
root@ip-10-0-0-66:/opt/machine-id# ssh -F /opt/machine-id/ssh_config root@ip-10-0-0-142
/opt/machine-id/ssh_config: line 10: Bad configuration option: pubkeyacceptedalgorithms
/opt/machine-id/ssh_config: terminating, 1 bad configuration options

Using

OpenSSH_8.2p1 Ubuntu-4ubuntu0.4, OpenSSL 1.1.1f  31 Mar 2020

What you expected to happen:
@benarent
Copy link
Contributor Author

benarent commented Mar 8, 2022

I removed the PubkeyAcceptedAlgorithms [email protected] line from my config. But I wasn't able to access my host.

# ssh -vv -F /opt/machine-id/ssh_config root@ip-10-0-0-142
OpenSSH_8.2p1 Ubuntu-4ubuntu0.4, OpenSSL 1.1.1f  31 Mar 2020
debug1: Reading configuration data /opt/machine-id/ssh_config
debug2: resolving "ip-10-0-0-142" port 22
debug2: ssh_connect_direct
debug1: Connecting to ip-10-0-0-142 [10.0.0.142] port 22.
debug1: Connection established.
debug1: identity file /root/.ssh/id_rsa type -1
debug1: identity file /root/.ssh/id_rsa-cert type -1
debug1: identity file /root/.ssh/id_dsa type -1
debug1: identity file /root/.ssh/id_dsa-cert type -1
debug1: identity file /root/.ssh/id_ecdsa type -1
debug1: identity file /root/.ssh/id_ecdsa-cert type -1
debug1: identity file /root/.ssh/id_ecdsa_sk type -1
debug1: identity file /root/.ssh/id_ecdsa_sk-cert type -1
debug1: identity file /root/.ssh/id_ed25519 type -1
debug1: identity file /root/.ssh/id_ed25519-cert type -1
debug1: identity file /root/.ssh/id_ed25519_sk type -1
debug1: identity file /root/.ssh/id_ed25519_sk-cert type -1
debug1: identity file /root/.ssh/id_xmss type -1
debug1: identity file /root/.ssh/id_xmss-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_8.2p1 Ubuntu-4ubuntu0.4
debug1: Remote protocol version 2.0, remote software version OpenSSH_8.2p1 Ubuntu-4ubuntu0.4
debug1: match: OpenSSH_8.2p1 Ubuntu-4ubuntu0.4 pat OpenSSH* compat 0x04000000
debug2: fd 3 setting O_NONBLOCK
debug1: Authenticating to ip-10-0-0-142:22 as 'root'
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug2: local client KEXINIT proposal
debug2: KEX algorithms: curve25519-sha256,[email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,ext-info-c
debug2: host key algorithms: [email protected],[email protected],[email protected],ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],ssh-ed25519,[email protected],rsa-sha2-512,rsa-sha2-256,ssh-rsa
debug2: ciphers ctos: [email protected],aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected]
debug2: ciphers stoc: [email protected],aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected]
debug2: MACs ctos: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: MACs stoc: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: compression ctos: none,[email protected],zlib
debug2: compression stoc: none,[email protected],zlib
debug2: languages ctos: 
debug2: languages stoc: 
debug2: first_kex_follows 0 
debug2: reserved 0 
debug2: peer server KEXINIT proposal
debug2: KEX algorithms: curve25519-sha256,[email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256
debug2: host key algorithms: rsa-sha2-512,rsa-sha2-256,ssh-rsa,ecdsa-sha2-nistp256,ssh-ed25519
debug2: ciphers ctos: [email protected],aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected]
debug2: ciphers stoc: [email protected],aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected]
debug2: MACs ctos: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: MACs stoc: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: compression ctos: none,[email protected]
debug2: compression stoc: none,[email protected]
debug2: languages ctos: 
debug2: languages stoc: 
debug2: first_kex_follows 0 
debug2: reserved 0 
debug1: kex: algorithm: curve25519-sha256
debug1: kex: host key algorithm: ecdsa-sha2-nistp256
debug1: kex: server->client cipher: [email protected] MAC: <implicit> compression: none
debug1: kex: client->server cipher: [email protected] MAC: <implicit> compression: none
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ecdsa-sha2-nistp256 SHA256:MPYcVxWXsv93mJiwNLBf3C3c1VGBV9HmNwxwmCzlxtw
debug1: Host 'ip-10-0-0-142' is known and matches the ECDSA host key.
debug1: Found key in /root/.ssh/known_hosts:1
debug2: set_newkeys: mode 1
debug1: rekey out after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug2: set_newkeys: mode 0
debug1: rekey in after 134217728 blocks
debug1: Will attempt key:  RSA-CERT SHA256:UsFTPCnuujHnf/gxIdN0M2cFqBc+5KCHOntXbzyIJ5A agent
debug1: Will attempt key: /root/.ssh/id_rsa 
debug1: Will attempt key: /root/.ssh/id_dsa 
debug1: Will attempt key: /root/.ssh/id_ecdsa 
debug1: Will attempt key: /root/.ssh/id_ecdsa_sk 
debug1: Will attempt key: /root/.ssh/id_ed25519 
debug1: Will attempt key: /root/.ssh/id_ed25519_sk 
debug1: Will attempt key: /root/.ssh/id_xmss 
debug2: pubkey_prepare: done
debug1: SSH2_MSG_EXT_INFO received
debug1: kex_input_ext_info: server-sig-algs=<ssh-ed25519,[email protected],ssh-rsa,rsa-sha2-256,rsa-sha2-512,ssh-dss,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,[email protected]>
debug2: service_accept: ssh-userauth
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey
debug1: Next authentication method: publickey
debug1: Offering public key:  RSA-CERT SHA256:UsFTPCnuujHnf/gxIdN0M2cFqBc+5KCHOntXbzyIJ5A agent
debug2: we sent a publickey packet, wait for reply
debug1: Authentications that can continue: publickey
debug1: Trying private key: /root/.ssh/id_rsa
debug1: Trying private key: /root/.ssh/id_dsa
debug1: Trying private key: /root/.ssh/id_ecdsa
debug1: Trying private key: /root/.ssh/id_ecdsa_sk
debug1: Trying private key: /root/.ssh/id_ed25519
debug1: Trying private key: /root/.ssh/id_ed25519_sk
debug1: Trying private key: /root/.ssh/id_xmss
debug2: we did not send a packet, disable method
debug1: No more authentication methods to try.
root@ip-10-0-0-142: Permission denied (publickey).

@timothyb89
Copy link
Contributor

I think this is at least partially related to #10781

@benarent
Copy link
Contributor Author

benarent commented Mar 8, 2022

Yes, the permission denied was due to not adding the cluster name. Marking this as duplicate of #10781

@benarent
Copy link
Contributor Author

benarent commented Mar 8, 2022

Duplicate of #10781

@benarent benarent marked this as a duplicate of #10781 Mar 8, 2022
@timothyb89
Copy link
Contributor

I believe this should be fixed now that #10833 has been merged

@russjones
Copy link
Contributor

Tested this with 9.0.0 and it's resolved now, closing.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@zmb3 zmb3

Labels
bug machine-id
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
4 participants
@benarent @timothyb89 @russjones @zmb3