Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #211454 > unrolled thread

id_dsa - not in PubkeyAcceptedKeyTypes

Started byPierre Frenkiel <pierre.frenkiel@gmail.com>
First post2019-07-17 12:20 +0200
Last post2019-07-17 14:30 +0200
Articles 14 — 6 participants

Back to article view | Back to linux.debian.user

Contents

  id_dsa - not in PubkeyAcceptedKeyTypes Pierre Frenkiel <pierre.frenkiel@gmail.com> - 2019-07-17 12:20 +0200
    Re: id_dsa - not in PubkeyAcceptedKeyTypes <tomas@tuxteam.de> - 2019-07-17 12:30 +0200
      Re: id_dsa - not in PubkeyAcceptedKeyTypes Pierre Frenkiel <pierre.frenkiel@gmail.com> - 2019-07-17 12:50 +0200
        Re: id_dsa - not in PubkeyAcceptedKeyTypes <tomas@tuxteam.de> - 2019-07-17 13:10 +0200
        Re: id_dsa - not in PubkeyAcceptedKeyTypes Michael Kesper <mkesper@schokokeks.org> - 2019-07-17 13:10 +0200
    Re: id_dsa - not in PubkeyAcceptedKeyTypes Brad Rogers <brad@fineby.me.uk> - 2019-07-17 12:30 +0200
    Re: id_dsa - not in PubkeyAcceptedKeyTypes Stephan Seitz <stse+debian@fsing.rootsland.net> - 2019-07-17 13:10 +0200
      Re: id_dsa - not in PubkeyAcceptedKeyTypes <tomas@tuxteam.de> - 2019-07-17 13:20 +0200
      Re: id_dsa - not in PubkeyAcceptedKeyTypes Pierre Frenkiel <pierre.frenkiel@gmail.com> - 2019-07-17 13:20 +0200
        Re: id_dsa - not in PubkeyAcceptedKeyTypes Stephan Seitz <stse+debian@fsing.rootsland.net> - 2019-07-17 13:30 +0200
          Re: id_dsa - not in PubkeyAcceptedKeyTypes Pierre Frenkiel <pierre.frenkiel@gmail.com> - 2019-07-17 14:30 +0200
            Re: id_dsa - not in PubkeyAcceptedKeyTypes Greg Wooledge <wooledg@eeg.ccf.org> - 2019-07-17 15:00 +0200
        Re: id_dsa - not in PubkeyAcceptedKeyTypes Brad Rogers <brad@fineby.me.uk> - 2019-07-17 13:30 +0200
        Re: id_dsa - not in PubkeyAcceptedKeyTypes Michael Kesper <mkesper@schokokeks.org> - 2019-07-17 14:30 +0200

#211454 — id_dsa - not in PubkeyAcceptedKeyTypes

FromPierre Frenkiel <pierre.frenkiel@gmail.com>
Date2019-07-17 12:20 +0200
Subjectid_dsa - not in PubkeyAcceptedKeyTypes
Message-ID<ykPcu-41q-7@gated-at.bofh.it>
hi,
  have When trying a passwordless connection via ssh, I have now the message:
     id_dsa - not in PubkeyAcceptedKeyTypes
although it is actually in /etc/ssh/sshd_config

It worked until yesterday, but I'm unable to find what config change can
give this result...


best regards,
-- 
Pierre Frenkiel

[toc] | [next] | [standalone]

#211455

From<tomas@tuxteam.de>
Date2019-07-17 12:30 +0200
Message-ID<ykPma-44T-11@gated-at.bofh.it>
In reply to#211454

[Multipart message — attachments visible in raw view] — view raw

On Wed, Jul 17, 2019 at 12:14:36PM +0200, Pierre Frenkiel wrote:
> hi,
>  have When trying a passwordless connection via ssh, I have now the message:
>     id_dsa - not in PubkeyAcceptedKeyTypes
> although it is actually in /etc/ssh/sshd_config
> 
> It worked until yesterday, but I'm unable to find what config change can
> give this result...

Perhaps it's the server who changed its mind?

What's the output if you try to add the -v option ("verbose") to
your ssh connection attempt?

Cheers
-- tomás

[toc] | [prev] | [next] | [standalone]

#211457

FromPierre Frenkiel <pierre.frenkiel@gmail.com>
Date2019-07-17 12:50 +0200
Message-ID<ykPFw-4br-3@gated-at.bofh.it>
In reply to#211455

[Multipart message — attachments visible in raw view] — view raw

On Wed, 17 Jul 2019, tomas@tuxteam.de wrote:

> Perhaps it's the server who changed its mind?
>
> What's the output if you try to add the -v option ("verbose") to
> your ssh connection attempt?
>
> Cheers
> -- tomás
>
  it's the -v option which gives " id_dsa - not in PubkeyAcceptedKeyTypes

best regards,
-- 
Pierre Frenkiel

[toc] | [prev] | [next] | [standalone]

#211460

From<tomas@tuxteam.de>
Date2019-07-17 13:10 +0200
Message-ID<ykPYR-4xE-11@gated-at.bofh.it>
In reply to#211457

[Multipart message — attachments visible in raw view] — view raw

On Wed, Jul 17, 2019 at 12:42:42PM +0200, Pierre Frenkiel wrote:
> On Wed, 17 Jul 2019, tomas@tuxteam.de wrote:
> 
> >Perhaps it's the server who changed its mind?
> >
> >What's the output if you try to add the -v option ("verbose") to
> >your ssh connection attempt?
> >
> >Cheers
> >-- tomás
> >
>  it's the -v option which gives " id_dsa - not in PubkeyAcceptedKeyTypes

Yep. But is it the server rejecting it? Then you'd have to "fix" the server
(or adapt to it).

Cheers
-- t

[toc] | [prev] | [next] | [standalone]

#211461

FromMichael Kesper <mkesper@schokokeks.org>
Date2019-07-17 13:10 +0200
Message-ID<ykPYR-4xE-13@gated-at.bofh.it>
In reply to#211457

[Multipart message — attachments visible in raw view] — view raw

Hi Pierre,

On 17.07.19 12:42, Pierre Frenkiel wrote:
>  it's the -v option which gives " id_dsa - not in PubkeyAcceptedKeyTypes

Try -vvvv. :)
id_dsa is deprecated though, probably you want to switch to a more secure
key type anyway.

Best wishes
Michael

[toc] | [prev] | [next] | [standalone]

#211456

FromBrad Rogers <brad@fineby.me.uk>
Date2019-07-17 12:30 +0200
Message-ID<ykPma-44T-13@gated-at.bofh.it>
In reply to#211454

[Multipart message — attachments visible in raw view] — view raw

On Wed, 17 Jul 2019 12:14:36 +0200 (CEST)
Pierre Frenkiel <pierre.frenkiel@gmail.com> wrote:

Hello Pierre,

>  have When trying a passwordless connection via ssh, I have now the
> message: id_dsa - not in PubkeyAcceptedKeyTypes
>although it is actually in /etc/ssh/sshd_config

IDK whether it's relevant to your problem, but this announcement from
the 12th, may be helpful;

openssh (1:8.0p1-1) experimental; urgency=medium

  OpenSSH 8.0 includes a number of changes that may affect existing
  configurations:

   * sshd(8): Remove support for obsolete "host/port" syntax.
     Slash-separated host/port was added in 2001 as an alternative to
     host:port syntax for the benefit of IPv6 users.  These days there
     are established standards for this like [::1]:22 and the slash
     syntax is easily mistaken for CIDR notation, which OpenSSH supports
     for some things.  Remove the slash notation from ListenAddress and
     PermitOpen.

-- 
 Regards  _
         / )           "The blindingly obvious is
        / _)rad        never immediately apparent"
You destroyed my confidence, you broke my nerve
Nervous Wreck - Radio Stars

[toc] | [prev] | [next] | [standalone]

#211459

FromStephan Seitz <stse+debian@fsing.rootsland.net>
Date2019-07-17 13:10 +0200
Message-ID<ykPYR-4xE-7@gated-at.bofh.it>
In reply to#211454

[Multipart message — attachments visible in raw view] — view raw

On Mi, Jul 17, 2019 at 12:14:36 +0200, Pierre Frenkiel wrote:
> have When trying a passwordless connection via ssh, I have now the 
> message:
>    id_dsa - not in PubkeyAcceptedKeyTypes
>although it is actually in /etc/ssh/sshd_config

According to the buster manpage of sshd_config:

PubkeyAcceptedKeyTypes
       Specifies the key types that will be accepted for public key 
       authentication as a list of comma-separated patterns. Alternately 
       if the specified value begins with a ‘+’ character, then the 
       specified key types will be appended to the default set instead of 
       replacing them. If the specified value begins with a ‘-’ 
       character, then the specified key types (including wildcards) will 
       be removed from the default set instead of re‐
       placing them. The default for this option is:

	  ecdsa-sha2-nistp256-cert-v01@openssh.com,
	  ecdsa-sha2-nistp384-cert-v01@openssh.com,
	  ecdsa-sha2-nistp521-cert-v01@openssh.com,
	  ssh-ed25519-cert-v01@openssh.com,
	  rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,
	  ssh-rsa-cert-v01@openssh.com,
	  ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
	  ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa

       The list of available key types may also be obtained using "ssh -Q key".


So there is nothing for dsa, only ecdsa.

The default list in stretch is shorter but doesn’t have a dsa type 
either.

Shade and sweet water!

	Stephan

-- 
| Public Keys: http://fsing.rootsland.net/~stse/keys.html |

[toc] | [prev] | [next] | [standalone]

#211462

From<tomas@tuxteam.de>
Date2019-07-17 13:20 +0200
Message-ID<ykQ8x-4B0-1@gated-at.bofh.it>
In reply to#211459

[Multipart message — attachments visible in raw view] — view raw

On Wed, Jul 17, 2019 at 01:13:14PM +0200, Pierre Frenkiel wrote:
> On Wed, 17 Jul 2019, Stephan Seitz wrote:
> 
> >According to the buster manpage of sshd_config:
> >
> >PubkeyAcceptedKeyTypes
> >     Specifies the key types that will be accepted for public key
> >authentication as a list of comma-separated patterns. Alternately
> >if the specified value begins with a + character, then the
> >specified key types will be appended to the default set instead of
> >replacing them. If the specified value begins with a -
> >character, then the specified key types (including wildcards) will
> >be removed from the default set instead of re
> >     placing them. The default for this option is:
> >
> >	  ecdsa-sha2-nistp256-cert-v01@openssh.com,
> >	  ecdsa-sha2-nistp384-cert-v01@openssh.com,
> >	  ecdsa-sha2-nistp521-cert-v01@openssh.com,
> >	  ssh-ed25519-cert-v01@openssh.com,
> >	  rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,
> >	  ssh-rsa-cert-v01@openssh.com,
> >	  ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
> >	  ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa
> >
> 
>   thanks, but I've still 2 questions:
> 
>   1/ why something which worked yesterday doesn't work today?
>   2/ what would be the recommended key in this long list?

I can only repeat my former question: either the client or the
server changed. Did the server get an update, for example?

To your second question... I don't know. Perhaps someone else
chimes in.

Cheers
-- t

[toc] | [prev] | [next] | [standalone]

#211463

FromPierre Frenkiel <pierre.frenkiel@gmail.com>
Date2019-07-17 13:20 +0200
Message-ID<ykQ8x-4B0-3@gated-at.bofh.it>
In reply to#211459
On Wed, 17 Jul 2019, Stephan Seitz wrote:

> According to the buster manpage of sshd_config:
>
> PubkeyAcceptedKeyTypes
>      Specifies the key types that will be accepted for public key 
> authentication as a list of comma-separated patterns. Alternately       if the 
> specified value begins with a + character, then the       specified key 
> types will be appended to the default set instead of       replacing them. If 
> the specified value begins with a -       character, then the specified key 
> types (including wildcards) will       be removed from the default set instead 
> of re
>      placing them. The default for this option is:
>
> 	  ecdsa-sha2-nistp256-cert-v01@openssh.com,
> 	  ecdsa-sha2-nistp384-cert-v01@openssh.com,
> 	  ecdsa-sha2-nistp521-cert-v01@openssh.com,
> 	  ssh-ed25519-cert-v01@openssh.com,
> 	  rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,
> 	  ssh-rsa-cert-v01@openssh.com,
> 	  ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
> 	  ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa
>

   thanks, but I've still 2 questions:

   1/ why something which worked yesterday doesn't work today?
   2/ what would be the recommended key in this long list?

best regards,
-- 
Pierre Frenkiel

[toc] | [prev] | [next] | [standalone]

#211464

FromStephan Seitz <stse+debian@fsing.rootsland.net>
Date2019-07-17 13:30 +0200
Message-ID<ykQid-4Eq-11@gated-at.bofh.it>
In reply to#211463

[Multipart message — attachments visible in raw view] — view raw

On Mi, Jul 17, 2019 at 01:13:14 +0200, Pierre Frenkiel wrote:
>  1/ why something which worked yesterday doesn't work today?

I don’t know. Are you in control of the server? If yes, did you do an 
update/upgrade? If not, can you ask the admin?

>  2/ what would be the recommended key in this long list?

Sorry, no idea.

Shade and sweet water!

	Stephan

-- 
| Public Keys: http://fsing.rootsland.net/~stse/keys.html |

[toc] | [prev] | [next] | [standalone]

#211466

FromPierre Frenkiel <pierre.frenkiel@gmail.com>
Date2019-07-17 14:30 +0200
Message-ID<ykRei-5dM-5@gated-at.bofh.it>
In reply to#211464
On Wed, 17 Jul 2019, Stephan Seitz wrote:

> On Mi, Jul 17, 2019 at 01:13:14 +0200, Pierre Frenkiel wrote:
>>  1/ why something which worked yesterday doesn't work today?
>
> I dont know. Are you in control of the server? If yes, did you do an 
> update/upgrade? If not, can you ask the admin?

     yes, I am both user and admin.
     I did an upgrade, but only for the libreoffice packages
     So, nothing to do with ssh
     And I still not understand, even if id_dsa is obsolete, the message

          id_dsa - not in PubkeyAcceptedKeyTypes

best regards,
-- 
Pierre Frenkiel

[toc] | [prev] | [next] | [standalone]

#211469

FromGreg Wooledge <wooledg@eeg.ccf.org>
Date2019-07-17 15:00 +0200
Message-ID<ykRHk-5ow-3@gated-at.bofh.it>
In reply to#211466
On Wed, Jul 17, 2019 at 02:23:03PM +0200, Pierre Frenkiel wrote:
>     yes, I am both user and admin.
>     I did an upgrade, but only for the libreoffice packages
>     So, nothing to do with ssh
>     And I still not understand, even if id_dsa is obsolete, the message
> 
>          id_dsa - not in PubkeyAcceptedKeyTypes

The real question is "how on earth did it work yesterday?!".

http://www.openssh.com/legacy.html

https://security.stackexchange.com/questions/112802/why-openssh-deprecated-dsa-keys

https://superuser.com/questions/1016989/ssh-dsa-keys-no-longer-work-for-password-less-authentication

etc., etc., etc.

[toc] | [prev] | [next] | [standalone]

#211465

FromBrad Rogers <brad@fineby.me.uk>
Date2019-07-17 13:30 +0200
Message-ID<ykQid-4Eq-9@gated-at.bofh.it>
In reply to#211463

[Multipart message — attachments visible in raw view] — view raw

On Wed, 17 Jul 2019 13:13:14 +0200 (CEST)
Pierre Frenkiel <pierre.frenkiel@gmail.com> wrote:

Hello Pierre,

>   1/ why something which worked yesterday doesn't work today?

Software update, rebooting are just two possibilities.

-- 
 Regards  _
         / )           "The blindingly obvious is
        / _)rad        never immediately apparent"
Tell the dinosaurs they just won't survive
The History Of The World (Part 1) - The Damned

[toc] | [prev] | [next] | [standalone]

#211467

FromMichael Kesper <mkesper@schokokeks.org>
Date2019-07-17 14:30 +0200
Message-ID<ykRei-5dM-13@gated-at.bofh.it>
In reply to#211463

[Multipart message — attachments visible in raw view] — view raw

Hi Pierre,

On 17.07.19 13:13, Pierre Frenkiel wrote:
>   thanks, but I've still 2 questions:
> 
>   1/ why something which worked yesterday doesn't work today?

You'll note this often happens in IT due to the sheer number of
moving parts (updates, changes of infrastructure, ...)

>   2/ what would be the recommended key in this long list?

Cryptographic advice is a matter of a) research and b) trust.

Some hopefully knowledgeable people wrote a blog entry
with recommendations:
https://paragonie.com/blog/2019/03/definitive-2019-guide-cryptographic-key-sizes-and-algorithm-recommendations

There exists also this site that lists different 
recognized recommendations:
https://www.keylength.com

Best wishes
Michael

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.user

csiph-web