12

I'm trying to test the order in which keys are tried. One of the system's users is using DSA, so I'm trying to test it as an option. I'm getting a Bad key types.

$ ssh -vv -p 1522 jwalton@192.168.1.11
OpenSSH_7.1p1, OpenSSL 1.0.2d 9 Jul 2015
debug1: Reading configuration data /Users/jwalton/.ssh/config
/Users/jwalton/.ssh/config line 2: Bad key types 'ssh-ed25519,ecdsa-sha2-nistp256,ssh-dsa,ssh-rsa'.

I narrowed it down to ssh-dsa. According to ssh_config(5) (its actually part of sshd_config(5), but its listed as a new ssh_config feature in the OpenSSH 7.0 release notes):

 The -Q option of ssh(1) may be used to list supported key types.

However, I can't seem to get it to work:

riemann::~$ ssh -Q 
/usr/local/bin/ssh: option requires an argument -- Q
riemann::~$ ssh -Q dsa
Unsupported query "dsa"
riemann::~$ ssh -Q ssh-dsa
Unsupported query "ssh-dsa"
riemann::~$ ssh -Q ed25529
Unsupported query "ed25529"
riemann::~$ ssh -Q ssh-ed25529
Unsupported query "ssh-ed25529"
riemann::~$ ssh -Q PubkeyAcceptedKeyTypes
Unsupported query "PubkeyAcceptedKeyTypes"

How does one use the ssh -Q option?

What is the key type for ssh-dsa?

14

Reading manual pages should help you:

 -Q cipher | cipher-auth | mac | kex | key | protocol-version

Queries ssh for the algorithms supported for the specified version 2. The available features are: cipher (supported symmetric ciphers), cipher-auth (supported symmetric ciphers that support authenticated encryption), mac (supported message integrity codes), kex (key exchange algorithms), key (key types) and protocol-version (supported SSH protocol versions).

Calling ssh -Q key gives you what you want:

ssh -Q key
ssh-ed25519
ssh-ed25519-cert-v01@openssh.com
ssh-rsa
ssh-dss
ecdsa-sha2-nistp256
ecdsa-sha2-nistp384
ecdsa-sha2-nistp521
ssh-rsa-cert-v01@openssh.com
ssh-dss-cert-v01@openssh.com
ecdsa-sha2-nistp256-cert-v01@openssh.com
ecdsa-sha2-nistp384-cert-v01@openssh.com
ecdsa-sha2-nistp521-cert-v01@openssh.com

This is new feature in openssh-7.0 so remember that it doesn't have to work in older versions.

ssh-dsa key type is ssh-dss and it is disabled by default in this version.

  • Thanks. What man page were you in? – jww Aug 26 '15 at 13:13
  • 2
    "ssh-dsa key type is ssh-dss and it is disabled by default in this version." - OK, thanks. Is there a reason it is disabled by default? DSA2 has 112-bits of security (equivalent to 2048-bit RSA), so its not weak/wounded like a 512-bit or 768-bit moduli. Also, DSS includes RSA and ECDSA, so its clearly disabling DSA, and not DSS. – jww Aug 26 '15 at 13:16
  • 1
    Not in the man pages here with Fedora 23 beta; but ssh -Q key does work. Unfortunately the keys on my machine are not supported now. – mikebabcock Sep 28 '15 at 1:56
  • 3
    @PavelŠimerda How is this related to DNS? You mean DSA? This is exactly what is the PubkeyAcceptedKeyTypes option for. If you add it to your ssh_config with +ssh-dss value, you should be able to accept DSA keys on server. On server you can use HostKeyAlgorithms as described in release notes: openssh.com/txt/release-7.0 – Jakuje Oct 5 '15 at 21:20
  • 1
    @DavidFaure It does not explain why, it was disabled it just says it was disabled and how to handle it – Jakuje Jun 13 '16 at 16:42
0

For reference, an answer posted in unix.stackexchange.com helped us fix the issue:

The new openssh version (7.0+) deprecated DSA keys and is not using DSA keys by default (not on server or client). The keys are not preferred to be used anymore, so if you can, I would recommend to use RSA keys where possible.

If you really need to use DSA keys, you need to explicitly allow them in your client config using

PubkeyAcceptedKeyTypes +ssh-dss Should be enough to put that line in ~/.ssh/config, as the verbose message is trying to tell you.

https://unix.stackexchange.com/a/247614/39540

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.