On 14Aug2023 09:18, François Patte <francois.patte(a)mi.parisdescartes.fr> wrote:
Here is the part I get with ssh -v:
debug1: Next authentication method: publickey
debug1: Offering public key: /home/patte/.ssh/id_rsa RSA SHA256:
**************************
I have a server accepts line after this:
debug1: Next authentication method: publickey
debug1: Offering public key: /Users/cameron/.ssh/id_rsa RSA SHA256:***** agent
debug1: Server accepts key: /Users/cameron/.ssh/id_rsa RSA SHA256:***** agent
Do you?
If I go "ssh -G hostname | grep -i pubkey" I get this:
pubkeyauthentication true
ignoreunknown PubkeyAcceptedKeyTypes,ProxyJump
pubkeyacceptedalgorithms
ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-ed25519,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,rsa-sha2-512,rsa-sha2-256,ssh-dss
What's that say for your "pubkeyacceptedalgorithms" ?
>I suspect some ssh configuration has changed with the upgrade,
>possibly in /etc/ssh/ssh_config. Certainly some key types (or smaller
>sizes) fall out of favour as they become inadequately secure.
Where will it be mentionned?
I expect the default is wired into the ssh client command. You can add a
particular algorithm back in with a ~/.ssh/config line like this:
PubkeyAcceptedAlgorithms +missing-name-here
But algorithms are disabled for a reason; after diagnosing this issue,
you should probably make yourself an additional keypair of an accepted
type and add its public half where wanted.
Cheers,
Cameron Simpson <cs(a)cskk.id.au>