I have already done some researches online, and the best solution seems to use a better algorithm to generate new key pairs. But right now I still need to use ssh-dss key pairs for internal automation.
(I know that since openssh 7.0, ssh-dss is disabled by default, we need to explicitly add
PubkeyAcceptedKeyTypes +ssh-dssto ssh configuration to re-enable it.)
OpenSSH_8.0p1, OpenSSL 1.1.1c FIPS 28 May 2019 Linux hostname 5.1.19-300.fc30.x86_64 #1 SMP Mon Jul 22 16:32:45 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux
Here is the checklist for what I have done so far:
- Create a user with password (some posts said that it might need a password)
.sshfolder, set the public key in
.ssh/authorized_keys, make sure that they have 700, 600 permission and right owner rather than root.
/etc/ssh/sshd_config, make sure that we have
PubkeyAuthentication yes(usually it's default value)
- Explicitly enable
~/.ssh/configon both server and client sides
- Restart sshd service to pick the new change
However, I was still asked for password.
/var/log/secure, I see:
userauth_pubkey: key type ssh-dss not in PubkeyAcceptedKeyTypes
ssh -Q key:
ssh-ed25519 firstname.lastname@example.org ssh-rsa ssh-dss ecdsa-sha2-nistp256 ecdsa-sha2-nistp384 ecdsa-sha2-nistp521 email@example.com firstname.lastname@example.org email@example.com firstname.lastname@example.org email@example.com
Looks like that the
ssh-dss should be in the list already, why I still see that error when ssh with private key file?
I did not got much more information from
/var/log/secure after I set ssh log level to
Jul 28 18:40:44 re-pkg-fedora30 sshd: Connection from 10.32.34.60 port 63863 on 10.140.143.132 port 22 Jul 28 18:40:44 re-pkg-fedora30 sshd: Failed publickey for mambop from 10.32.34.60 port 63863 ssh2: RSA SHA256:7EgHyu1SFM76cXlMGxHcvqg/C2xqbfbrQCfX5WCnOgc Jul 28 18:40:44 re-pkg-fedora30 sshd: userauth_pubkey: key type ssh-dss not in PubkeyAcceptedKeyTypes [preauth] Jul 28 18:40:45 re-pkg-fedora30 sshd: Connection closed by authenticating user mambop 10.32.34.60 port 63863 [preauth]