shellhub: change RSA SSH key generation to AES256

[henrybarreto]

Currently, the Shellhub has used RSA SHA1 for SSH connection. This commit
change the hashing algorithm from the default, SHA1, to AES256.

On the update of OpenSSH to version 8.8, the RSA SHA1 key was deprecated,
making connection from clients from this version needs an extra param to
connect.

This release disables RSA signatures using the SHA-1 hash algorithm
by default. This change has been made as the SHA-1 hash algorithm is
cryptographically broken, and it is possible to create chosen-prefix
hash collisions for <USD$50K [1]

https://www.openssh.com/txt/release-8.8

[henrybarreto]

https://www.openssh.com/txt/release-8.8

As the Change log from OpenSSH 8.8 says, and it took me a while to understand, ssh-rsa using SHA 1 was deprecated at once, but the key compatibilities haven't changed.

This release disables RSA signatures using the SHA-1 hash algorithm
by default. This change has been made as the SHA-1 hash algorithm is
cryptographically broken, and it is possible to create chosen-prefix
hash collisions for <USD$50K [1]

I guess it means that we need our server to have support for RSA SHA-2, but the package we use, or its decencies, does not implement.

• x/crypto/ssh: support RSA SHA-2 host key signatures golang/go#37278
• x/crypto/ssh: publicKeyCallback cannot handshake using ssh-rsa keys signed using the ssh-rsa-sha2-256 algorithm golang/go#39885
• https://go-review.googlesource.com/c/crypto/+/220037

If the system implements an old version of the protocol, extra configuration would be needed for it to work:
bash -oHostKeyAlgorithms=+ssh-rsa

As an example

ssh -oHostKeyAlgorithms=+ssh-rsa [email protected]@localhost

Incompatibility is more likely when connecting to older SSH
implementations that have not been upgraded or have not closely tracked
improvements in the SSH protocol. For these cases, it may be necessary
to selectively re-enable RSA/SHA1 to allow connection and/or user
authentication via the HostkeyAlgorithms and PubkeyAcceptedAlgorithms
options. For example, the following stanza in ~/.ssh/config will enable
RSA/SHA1 for host and user authentication for a single destination host:

A good explanation's articles:

• https://levelup.gitconnected.com/demystifying-ssh-rsa-in-openssh-deprecation-notice-22feb1b52acd
• https://www.linuxadictos.com/en/openssh-8-8-arrives-saying-goodbye-to-ssh-rsa-support-bug-fixes-and-more.html