wolpi / prim-ftpd

FTP server app for android
Other
580 stars 78 forks source link

RSA Key (with SHA256 or SHA512) not compatible #338

Closed dave0003 closed 2 months ago

dave0003 commented 3 months ago

I've tried authenticating with an rsa2048 key with SHA256 and an rsa4096 key with SHA512, but they're not accepted. I can create an ed25519 key just for this, and it does work with that.

For example:

debug1: send_pubkey_test: no mutual signature algorithm
debug1: Offering public key: /home/david/.ssh/id_rsa RSA SHA256:AXY0E3zeY2ca9M8kZOqzc41Pp8cmhNePlwYYgrzN+uB
debug1: send_pubkey_test: no mutual signature algorithm
debug1: Trying private key: /home/david/.ssh/id_ecdsa
debug1: Trying private key: /home/david/.ssh/id_ecdsa_sk
debug1: Trying private key: /home/david/.ssh/id_ed25519
debug1: Trying private key: /home/david/.ssh/id_ed25519_sk
debug1: Trying private key: /home/david/.ssh/id_xmss
debug1: Trying private key: /home/david/.ssh/id_dsa
debug1: No more authentication methods to try.
david@192.168.1.12: Permission denied (publickey).
Connection closed.

Also, trying to use these HostKeyAlgorithms gives no match: HostKeyAlgorithms rsa-sha2-512,rsa-sha2-256

debug1: kex: host key algorithm: (no match)
Unable to negotiate with 192.168.1.12 port 22: no matching host key type found. Their offer: ssh-ed25519,ssh-rsa,ssh-rsa
Connection closed.
dave0003 commented 2 months ago

I got it to accept the rsa keys (from a Yubikey) by overriding .ssh/config to include ssh-rsa.

rsa-sha2-512 & rsa-sha2-256 make it clear SHA2 is being used instead of the deprecated SHA1, and work normally on other systems.

  MACs hmac-sha2-512,hmac-sha2-256
  HostkeyAlgorithms ssh-rsa,ssh-ed25519
  PubkeyAcceptedKeyTypes ssh-rsa,ssh-ed25519
dave0003 commented 2 months ago

(Closing)