18

I'm trying to test the order in which keys are tried. One of the system's users is using DSA, so I'm trying to test it as an option. I'm getting a Bad key types.

$ ssh -vv -p 1522 [email protected]
OpenSSH_7.1p1, OpenSSL 1.0.2d 9 Jul 2015
debug1: Reading configuration data /Users/jwalton/.ssh/config
/Users/jwalton/.ssh/config line 2: Bad key types 'ssh-ed25519,ecdsa-sha2-nistp256,ssh-dsa,ssh-rsa'.

I narrowed it down to ssh-dsa. According to ssh_config(5) (its actually part of sshd_config(5), but its listed as a new ssh_config feature in the OpenSSH 7.0 release notes):

 The -Q option of ssh(1) may be used to list supported key types.

However, I can't seem to get it to work:

riemann::~$ ssh -Q 
/usr/local/bin/ssh: option requires an argument -- Q
riemann::~$ ssh -Q dsa
Unsupported query "dsa"
riemann::~$ ssh -Q ssh-dsa
Unsupported query "ssh-dsa"
riemann::~$ ssh -Q ed25529
Unsupported query "ed25529"
riemann::~$ ssh -Q ssh-ed25529
Unsupported query "ssh-ed25529"
riemann::~$ ssh -Q PubkeyAcceptedKeyTypes
Unsupported query "PubkeyAcceptedKeyTypes"

How does one use the ssh -Q option?

What is the key type for ssh-dsa?

Improve this question

2 Answers 2

Reset to default
19

Reading manual pages should help you:

 -Q cipher | cipher-auth | mac | kex | key | protocol-version

Queries ssh for the algorithms supported for the specified version 2. The available features are: cipher (supported symmetric ciphers), cipher-auth (supported symmetric ciphers that support authenticated encryption), mac (supported message integrity codes), kex (key exchange algorithms), key (key types) and protocol-version (supported SSH protocol versions).

Calling ssh -Q key gives you what you want:

ssh -Q key
ssh-ed25519
[email protected]
ssh-rsa
ssh-dss
ecdsa-sha2-nistp256
ecdsa-sha2-nistp384
ecdsa-sha2-nistp521
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]

This is new feature in openssh-7.0 so remember that it doesn't have to work in older versions.

ssh-dsa key type is ssh-dss and it is disabled by default in this version.

Improve this answer
13
  • Thanks. What man page were you in?
    – jww
    Aug 26, 2015 at 13:13
  • 2
    "ssh-dsa key type is ssh-dss and it is disabled by default in this version." - OK, thanks. Is there a reason it is disabled by default? DSA2 has 112-bits of security (equivalent to 2048-bit RSA), so its not weak/wounded like a 512-bit or 768-bit moduli. Also, DSS includes RSA and ECDSA, so its clearly disabling DSA, and not DSS.
    – jww
    Aug 26, 2015 at 13:16
  • 1
    Not in the man pages here with Fedora 23 beta; but ssh -Q key does work. Unfortunately the keys on my machine are not supported now.
    – mikebabcock
    Sep 28, 2015 at 1:56
  • 3
    @PavelŠimerda How is this related to DNS? You mean DSA? This is exactly what is the PubkeyAcceptedKeyTypes option for. If you add it to your ssh_config with +ssh-dss value, you should be able to accept DSA keys on server. On server you can use HostKeyAlgorithms as described in release notes: openssh.com/txt/release-7.0
    – Jakuje
    Oct 5, 2015 at 21:20
  • 1
    @DavidFaure It does not explain why, it was disabled it just says it was disabled and how to handle it
    – Jakuje
    Jun 13, 2016 at 16:42
0

For reference, an answer posted in unix.stackexchange.com helped us fix the issue:

The new openssh version (7.0+) deprecated DSA keys and is not using DSA keys by default (not on server or client). The keys are not preferred to be used anymore, so if you can, I would recommend to use RSA keys where possible.

If you really need to use DSA keys, you need to explicitly allow them in your client config using

PubkeyAcceptedKeyTypes +ssh-dss Should be enough to put that line in ~/.ssh/config, as the verbose message is trying to tell you.

https://unix.stackexchange.com/a/247614/39540

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .