On 04/13/2016 05:39 PM, Rick Stevens wrote:
On 04/13/2016 01:04 PM, Tom Horsley wrote:
> On Wed, 13 Apr 2016 15:51:31 -0400
> Richard Heck wrote:
>
>> Any suggestions?
>
> Yep. The security geeks decided dsa keys weren't secure,
> but none of the errors messages you get give you a hint
> that dsa keys no longer work.
>
> You can change a lot of obscure parameters in /etc/sshd.config
> (and maybe /etc/ssh.config as well) or you can sigh and
> generate new keys using an "acceptable" cipher and
> distribute the new public key around to every single
> system that has your old dsa key.
You can use "ssh -o HostkeyAlgorithms +ssh-dss remotehost" to
temporarily use dsa keys, or add
Host *
HostkeyAlgorithms +ssh-dss
to your /etc/ssh/ssh_config or ~/.ssh/config file, but switch to rsa
when you can. The "experts" think its better and by default, ssh won't
use dss any more.
Also be aware that by default ssh no longer allows
diffie-hellman-group1-sha1 key exchange.
Again, you can "ssh -o KexAlgorithms +diffie-hellman-group1-sha1
remotehost" or add
Host *
KexAlgorithms +diffie-hellman-group1-sha
to your /etc/ssh/ssh_config or ~/.ssh/config files. Both of these have
gotten me trying to log into some older Cisco routers. I've added things
like
Host remote-cisco-gear
HostkeyAlgorithms +ssh-dss
KexAlgorithms +diffie-hellman-group1-sha1
for each of these problematic machines to my ~/.ssh/config file to get
around these issues. Grrrr!
Thanks for the detailed suggestions. The weird thing was that, after I
entered the
passphrase, it WOULD let me connect. And adding the various lines to
.ssh/config,
etc, didn't help with that problem. But using new RSA keys solves it.
Richard