2

I have been using Cygwin on Windows 10 for many years, and using ssh to access an AWS EC2 Amazon Linux instance for development. Recently, I bought a new Windows 10 PC, installed Cygwin in the usual way, and suddenly ssh stopped working, giving "Permission denied (publickey)." errors on any use. After all kinds of checking and guessing what might possibly be wrong (it still worked fine on my old PC), I tried downgrading the Cygwin package for OpenSSH. And that fixed the problem! Conversely, upgrading the Cygwin package for OpenSSH on my old PC broke it in the same way as on the new PC. Here is the output on the new PC, showing it broken with the latest package, and working with the slightly older package. The only thing I did between the two output was to run the Cygwin installer and downgrade the OpenSSH package.

Note that both packages report the same underlying version of OpenSSL, "OpenSSL 1.1.1l", so it would seem to be a problem in the way the package itself.

Any ideas?

repete@Rich-QX411 ~/.ssh
$ ssh -V
OpenSSH_8.8p1, OpenSSL 1.1.1l  24 Aug 2021

repete@Rich-QX411 ~/.ssh
$ ssh repete@dev.osh echo hello
repete@dev.osh: Permission denied (publickey).

======== Downgrade the OpenSSH package in another window ========

repete@Rich-QX411 ~/.ssh
$ ssh -V
OpenSSH_8.7p1, OpenSSL 1.1.1l  24 Aug 2021

repete@Rich-QX411 ~/.ssh
$ ssh repete@dev.osh echo hello
hello

repete@Rich-QX411 ~/.ssh
2
  • What sshd and which version is the server running?
    – user1686
    Oct 25 at 15:22
  • @user1686 Good question. It's old. My yum repository also seems to have suffered from age, but sshd -V shows "$ sshd -V unknown option -- V OpenSSH_6.6.1p1, OpenSSL 1.0.1e-fips 11 Feb 2013 "
    – sootsnoot
    Oct 25 at 16:42
3

As of version 8.8, OpenSSH no longer allows RSA signatures that are made using the SHA-1 hash algorithm. Existing RSA keys are still accepted, but they must be used together with SHA-256 instead. This applies both to signatures made with your user key from the client side, and to signatures made with the host key from the server side.

The first version of OpenSSH with rsa-sha2 support is 7.2.

If you need to connect to hosts which only provide RSA/SHA-1 host key signatures, and/or only accept RSA/SHA-1 user key signatures, add the following options to your ~/.ssh/config:

Host whatever.example.com
    HostKeyAlgorithms +ssh-rsa
    PubkeyAcceptedAlgorithms +ssh-rsa

If you need to make your OpenSSH 8.8 server accept clients which only accept RSA/SHA-1 host key signatures and/or only provide RSA/SHA-1 user key signatures, add the same options to the server's sshd_config (minus the 'Host' section).

4
  • Wow, thanks so much! What I thought I was doing was just setting up the new PC like the old one. It didn't occur to me that some Cygwin package had been updated in a way that made it incompatible with servers I'd been using for years... I love Cygwin, it's the most useful thing ever created for Windows PCs. But it's not strong on telling the end user about changes like this when they just blindly accept "pending" packages.
    – sootsnoot
    Oct 25 at 20:24
  • 1
    Have you read the announcement ? cygwin.com/pipermail/cygwin-announce/2021-October/010257.html
    – matzeri
    Oct 25 at 21:04
  • 1
    @matzeri No, I haven't. Is that from a Cygwin mailing list? I can't keep up with the volume of most mailing lists, as I'm just a user, not a developer. Is there a particular list that I should subscribe to that only contains critical stuff like breaking changes such as this? Can you point me at a resource that explains the mailing lists and how to subscribe to just the ones that are critical to end-users? Having used Cygwin for such a long time without being subscribed to any, and this is the first time I've been bitten by a breaking change, I suspect that I shouldn't need to track that much.
    – sootsnoot
    Oct 26 at 4:11
  • Duh, if I had just scrolled all the way to the bottom of the announcement, I would have seen the link to the page describing the cygwin-announce list. Sorry about that!
    – sootsnoot
    Oct 26 at 12:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.