hi
one of our user is trying to connect to sftp , is not able to connect ,
when i check /var/log/secure i can see below error in log.
can somebody please suggest what can be done for this?
localhost sshd: Unable to negotiate with xxx.xx.xxx.xx port xxxx: no matching host key type found. Their offer: ssh-rsa,ssh-dss [preauth]
localhost sshd[1875696]: Unable to negotiate with xx.xx.xxx.xx port xxxx: no matching key exchange method found. Their offer: diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 [preauth]
'the above issue we experience after we migrated from centos7 to rocky9 .
centos7 , this issue was not face by the same user.
hi jlehtone
thanks for the reply
i am just gone through this th site OpenSSH: Legacy Options
as per site i can imagine below 3 solutions, can you please suggest me ?
solution 1-
ssh -oHostKeyAlgorithms=+ssh-dss user@legacyhost
ssh -oKexAlgorithms=+diffie-hellman-group1-sha1 user@legacyhost
or
suggestion2:
end user should upgrade to latest openssh version 8 or laterm, if openssh upgrade is not possible, can we ask end user to use any latest winscp software which normally dont face any issue while connecting to rocky9 ssh/sftp
or solution3 :
we at our side , need to update the cyrpto-policies
update-crypto-policies --show (it shows default)
update-crypto-policies --set LEGACY OR update-crypto-policies --set DEFAULT:SHA1**
reboot
OR
if end user is using OpenSSH_7.2 , what we should suggest them?
if user is having openssh-7.2 version , what we can ask client to do at his side ?
in above mentioned solutions, is solution1 and solution3 both needs to apply together , or it can work independently ?
Note: The sshd of el7 (formally OpenSSH_7.4) seems to support by default:
kexalgorithms curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
hostkeyalgorithms ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss
I’m not sure which way you are connecting:
- legacy ssh client → el9 sshd
- el9 ssh client → legacy sshd
If the first, then logical options are:
- Enable algorithms in the legacy ssh client
- Get another ssh client
- Enable SHA1 in the el9 sshd (not preferred)
If the second, then options are:
- Replace legacy system (preferred)
- Enable algorithms in the legacy sshd
- Get another sshd to the legacy system (unlikely to be possible)
- Enable SHA1 for el9 ssh when connecting to legacy (not preferred)
hi jlehtone
thanks for the reply.
i m talking about legacy ssh client→ el9 sshd (rockylinux9 our side)
since i am not sure ( what is at end user side is using at legacy ssh client )
If the first, then logical options are:
1)Enable algorithms in the legacy ssh client
can we ask end user to follow something like this while ssh/sftp?
→ ssh -oHostKeyAlgorithms=+ssh-dss user@legacyhost
->ssh -oKexAlgorithms=+diffie-hellman-group1-sha1 user@legacyhost
2)Get another ssh client :- will try to convince end user for this
3)Enable SHA1 in the el9 sshd on our side (not preferred) :-
can we follow this process?
update-crypto-policies --set LEGACY OR update-crypto-policies --set DEFAULT:SHA1**
reboot
will try not to do this as fas as possible
Those look like “connect to legacy”. If the user is at legacyhost, then one would expect:
[user@legacyhost ~]$ ssh user@el9host
and the algorithms to add should be something that the sshd of el9host does support, not the legacy algos.
sshd -T shows that sshd on el9 does support (with DEFAULT policy):
kexalgorithms curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512
hostkeyalgorithms ecdsa-sha2-nistp256,ecdsa-sha2-nistp256-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519,ssh-ed25519-cert-v01@openssh.com,sk-ssh-ed25519@openssh.com,sk-ssh-ed25519-cert-v01@openssh.com,rsa-sha2-256,rsa-sha2-256-cert-v01@openssh.com,rsa-sha2-512,rsa-sha2-512-cert-v01@openssh.com
hi jlehtone
i m talking about legacy ssh client→ el9 sshd (rockylinux9 our side)
their is small modification , sorry for confusion,
i am still not clear for point 1.=, where we can ask end user who is using legacy client to change anything ? since we have migrated from centos7 to rocky9 , and after that i can see below 2 error message in /var/log/secure on rocky9 sever.
error1)Unable to negotiate with xxx.xxx.xx.xx port ****: no matching host key type found. Their offer: ssh-rsa,ssh-dss
error2) sshd[1875696]: Unable to negotiate with xx.xx.xxx.xx port xxxx: no matching key exchange method found. Their offer: diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 [preauth]
1)Enable algorithms in the legacy ssh client
can we ask end user to follow something like this while ssh/sftp?
→ ssh -oHostKeyAlgorithms=+ssh-dss user@el9host
->ssh -oKexAlgorithms=+diffie-hellman-group1-sha1 user@el9host
The el9 server saw that the legocy client did offer only ssh-rsa,ssh-dss.
If you say to legacy client to also offer ssh-dss (-oHostKeyAlgorithms=+ssh-dss), then the client still offers only ssh-rsa,ssh-dss.
Rather than +ssh-dss, you should + something form list:
ecdsa-sha2-nistp256,ecdsa-sha2-nistp256-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519,ssh-ed25519-cert-v01@openssh.com,sk-ssh-ed25519@openssh.com,sk-ssh-ed25519-cert-v01@openssh.com,rsa-sha2-256,rsa-sha2-256-cert-v01@openssh.com,rsa-sha2-512,rsa-sha2-512-cert-v01@openssh.com
that the ssh client can do (but for some reason does not by default).
ok so you mean to say we should ask client to send any one algo from below list for hostkeyalgorithms like example
ssh -oHostKeyAlgorithms=ecdsa-sha2-nistp256 user@el9host , and that should work ? but i m not sure what is supported at his side , i need to check what operating system he is trying from and accordingly we can suggest right?
ecdsa-sha2-nistp256,ecdsa-sha2-nistp256-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519,ssh-ed25519-cert-v01@openssh.com,sk-ssh-ed25519@openssh.com,sk-ssh-ed25519-cert-v01@openssh.com,rsa-sha2-256,rsa-sha2-256-cert-v01@openssh.com,rsa-sha2-512,rsa-sha2-512-cert-v01@openssh.com
and same rule apply for another error for example
ssh -oKexAlgorithms=+diffie-hellman-group14-sha256 user@el9host
kexalgorithms curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512
1 Like
hi [jlehtone]
can you please confirm if my last post reply is correct?