8

Apparently Fedora 35 does not list ssh-rsa in HostKeyAlgorithms or PubkeyAcceptedKeyTypes so trying to ssh from an old CentOS 6 machine yielded an error:

$ ssh as1s16.intra.corp.us
no hostkey alg

So I added options after the Include in /etc/ssh/sshd_config:

Include /etc/ssh/sshd_config.d/*.conf

HostKeyAlgorithms +ssh-rsa
PubkeyAcceptedKeyTypes +ssh-rsa

but same error. Then I ran sshd like this:

# /usr/sbin/sshd -ddd
...
debug3: /etc/ssh/sshd_config:20 setting HostKeyAlgorithms +ssh-rsa
debug3: /etc/ssh/sshd_config:21 setting PubkeyAcceptedKeyTypes +ssh-rsa
...
debug1: SELinux support disabled [preauth]
...
debug3: append_hostkey_type: ssh-rsa key not permitted by HostkeyAlgorithms [preauth]
debug1: list_hostkey_types: rsa-sha2-512,rsa-sha2-256,ecdsa-sha2-nistp256,ssh-ed25519 [preauth]

but same error. Then I removed the options ran sshd like this:

# /usr/sbin/sshd -ddd -oHostKeyAlgorithms=ssh-rsa

and it worked. I was able to successfully ssh in from the CentOS 6 client.

So then I put the options BEFORE the Include:

HostKeyAlgorithms +ssh-rsa
PubkeyAcceptedKeyTypes +ssh-rsa

# To modify the system-wide sshd configuration, create a  *.conf  file under
#  /etc/ssh/sshd_config.d/  which will be automatically included below
Include /etc/ssh/sshd_config.d/*.conf

and it worked.

Why would I need to put these directives BEFORE the Include? Shouldn't they go after to override the defaults?

2
  • 1
    "Shouldn't they go after to override the defaults?" No, sshd_config is first-directive-wins. They will have to go before to override the defaults. See man page: "For each keyword, the first obtained value will be used."
    – Jim L.
    Nov 29, 2021 at 7:39
  • Even if I had read that, I would not have understood it because it doesn't make sense. There should be an indented note in the man page about that. It would make more sense to derive new configurations by including different files. That is how code works and configuration directives essentially code. As it is, the "code" is one big set of static finals.
    – squarewav
    Nov 29, 2021 at 22:38

2 Answers 2

0

Although that wording isn't very clear, I suspect that the config.d/* directory is to allow separate config files for particular clients/users or incoming interface/port(s), as opposed to 'system-wide'. This would be similar to the use of sites/* directories in apache/httpd and nginx (and probably more) to allow each virtual host or application to be configured separately but still all be supported by one server. Look in those files to see if they contain Match lines (which should be followed by other real lines = not Match, comment, or blank) which means they apply to only certain connections and not all.

Include is textual. If you have a file

blich
Include file*
blech

where blich and blech don't contain Match lines but at least some file(s) do(es), then effectively blech becomes part of the last Match block from the concatenation of the files -- so the settings in blech are only used for incoming connections satisfying those Match condition(s), which your test connection apparently didn't.

If you want SSHD settings to be 'global' you must put them before any Match line(s), and if the Include'd file(s) contain(s) Match line(s) that means you must put the global settings before the Include.

All (used) settings in the config file override defaults in the program. Putting the same setting more than once in the config file (before/outside any Match blocks) uses the first one not the last, so your idea of overriding an earlier 'default' (which isn't a default at all if it's in the file) wouldn't work. Only when the later occurrence is in a Match block whose condition(s) is(are) satisfied does it override the first one.

PS: this presumably happened now because Fedora is bleeding-edge and OpenSSH recently changed this finally after warning (threatening?) they would do so since 8.2 a year and a half ago.

1
  • Regardless of whether the included files contain Match lines, any global declaration of either Key directive will override anything that comes later.
    – Jim L.
    Nov 29, 2021 at 7:38
0

I used:

HostKeyAlgorithms +ssh-rsa
PubkeyAcceptedAlgorithms +ssh-rsa

In /etc/ssh/sshd_config and restarted sshd.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .