Upgrade 22.12.3.3 to 23.10.1 breaks root SSH public key login

[FrankWard]

I just upgraded from 22.12.3.3 to 23.10.1 using the GUI. There have been a few odd things with services not starting and such, but the big issue I am facing is my root login does not work anymore with any keys. I can enable password based login and gain access to the shell, but the public key auth broke on upgrade and I have no idea how to fix it. Any insight would be appreciated!

 

[HoneyBadger]

Hey @FrankWard

Do you happen to know what algorithm your key is using? It looks like the underlying ssh server in Cobia dropped support for the ssh-rsa algorithm, so you might need to regenerate the key again with one of the supported ones:

Code:

debug2: peer server KEXINIT proposal
debug2: KEX algorithms: sntrup761x25519-sha512@openssh.com,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256
debug2: host key algorithms: rsa-sha2-512,rsa-sha2-256,ecdsa-sha2-nistp256,ssh-ed25519

Edit: It might be a little more complex than this; there's a potential interaction between the key and the client/server behavior. This article helps to explain it fairly well, and Bluefin -> Cobia definitely crossed the OpenSSH 8.8 version barrier discussed here (from 8.4 to 9.2)

RSA keys are not deprecated; SHA-1 signature scheme is!

Debugging "send_pubkey_test: no mutual signature algorithm" errors and demystifying the deprecation of "ssh-rsa" signature scheme in OpenSSH 8.8

ikarus.sg

 

[FrankWard]

Hey @FrankWard

Do you happen to know what algorithm your key is using? It looks like the underlying ssh server in Cobia dropped support for the ssh-rsa algorithm, so you might need to regenerate the key again with one of the supported ones:

Code:

debug2: peer server KEXINIT proposal
debug2: KEX algorithms: sntrup761x25519-sha512@openssh.com,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256
debug2: host key algorithms: rsa-sha2-512,rsa-sha2-256,ecdsa-sha2-nistp256,ssh-ed25519

Thank you. I missed that memo. Adding the 'PubkeyAcceptedAlgorithms +ssh-rsa' fixed the login. I'll look into creating an updated key.