I have recently upgraded my workstation - Fedora 31 to Fedora 34. As it usually happens after upgrade some of ssh alogrithms become obsoleted and I have to add extra lines to .ssh/config and I am okay with that doing my best on security.
This time ssh-rsa term confuse me a lot. I have old RSA public key, for instance it worked to authorize my openssh client against Debian 10, Debian 8 and Cisco 4k router.
After upgrade I have to add
PubkeyAcceptedKeyTypes +ssh-rsa to .ssh/config for most of older hosts, in this case it would be Debian 8 and Cisco 4k router. Now I can log in like i used to. But Cisco 4k log a message:
Public-key Algorithm compliance violation detected.Kindly note that weaker Public-key Algorithm 'ssh-rsa' will be disabled
Here are my questions:
- If Cisco 4k allow higher PK than ssh-rsa, why it does not work with default ssh settings?
- Is there any connection between key type "ssh-rsa" and allowed PK algorigthms, e.g. does public key type limit allowed algorightms by key length or anything?
- This authentication is always referred as ssh-rsa, but if I have to add it manually to config - what real PK authentication is used by default? Is it a sort of ssh-rsa or even some other type?
- Is there any way (I have tried ssh debug and sshd debug) to understand clearly what PK algorithms are supported on server and client like we do with ciphers?
New information about Cisco 4k router: By default Cisco support host key algorithms: rsa-sha2-512,rsa-sha2-256,ssh-rsa
I have added
PubkeyAcceptedKeyTypes +rsa-sha2-512 and I can log in, but still get warning about ssh-rsa.
Considering rsa-sha2-512 as a sort of ssh-rsa (because they both were dumped in recent openssh) my additional questions are:
- Does router statement seems to refer ssh-rsa as any type of ssh-rsa including rsa-sha2-512?
- Does host key algorithms enabled in router seem to be limited by some other means?