8

I have built a new Ubuntu server in AWS. Now for some reason my private key that works on other Ubuntu servers is not working her . The error in auth.log is

userauth_pubkey: key type ssh-rsa not in PubkeyAcceptedAlgorithms [preauth]

This only is an issue with Putty, if I try logging via a linux workstation no issues at all with any machine.

The difference I see is the new server is

Ubuntu 22.04.1 LTS running OpenSSH_8.9p1 Ubuntu-3, OpenSSL 3.0.2 15 Mar 2022

The working (old) server is

Ubuntu 20.04.4 LTS (Focal Fossa) running OpenSSH_8.2p1 Ubuntu-4ubuntu0.4, OpenSSL 1.1.1f 31 Mar 2020

Has something changed in this version of OpenSSH? How do I get putty working again?

1

2 Answers 2

6

A simple solution.

Add this line in /etc/ssh/sshd_config.

PubkeyAcceptedAlgorithms=+ssh-rsa

And then restart sshd service.

$ sudo systemctl restart sshd
2
  • 2
    This did not work for me. But what did work was upgrading putty from 0.74 to 0.78. Dec 21, 2022 at 19:57
  • 2
    @user2449151 same for me. Upgrading Putty solved the problem on Windows 11.
    – fillobotto
    Jan 18 at 10:20
5

There are several types of keys and signature algorithms in the SSH protocol. RSA keys, which have the key type ssh-rsa, can be used to sign with SHA-1 (in which case, the signature type is ssh-rsa), SHA-256 (which has signature type rsa-sha2-256), or SHA-512 (which has signature type rsa-sha2-512).

What you're seeing here is that you're connecting with an RSA key and using the ssh-rsa signature type with SHA-1. Unfortunately, SHA-1 is no longer secure, and the server is telling you that it won't accept that signature type. This is the right thing to do, because it avoids any security problems.

You can solve this in a couple different ways. First, you can simply upgrade PuTTY. The latest version supports the SHA-2 signature algorithms (SHA-256 and SHA-512), and so things should just work. You can also generate a different SSH key, say, an Ed25519 key, which is considered the most recommended option by Mozilla, GitHub, and other reputable parties. Note that PuTTY classes these as EdDSA keys, which is the more generic term; you want the 255 or 256 bit option.

You could also adjust PubkeyAcceptedKeyTypes in /etc/ssh/sshd_config on the server side to include ssh-rsa (you should also include all of the other options in ssh -Q sig as well if you do this). However, this means you're using insecure SHA-1 signatures and thus you probably want to choose one of the other options instead.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.