WIP: Implement support for rsa-sha2-256 key exchange. #971

yoyo-danielc · 2022-06-24T09:11:32Z

There doesn't appear to be any way to select different exchange methods depending on what the server supports for the same key, so this commit allows IPrivateKeySource to expose multiple key exchange methods for the same key and will try each one.

Tested on Ubuntu 18.04 and 22.04 with default SSH server config and with only ssh-rsa and rsa-sha2-256 key exchange enabled.

Not sure if this is necessarily the best design to go with, so haven't updated the tests yet.

A simpler approach would be to just replace ssh-rsa with rsa-sha2-256, which would prevent communication with old servers (OpenSSH 7.2 added rsa-sha2-256 support in 2016).

Based on @ml054's work in #825 (comment)

There doesn't appear to be any way to select different exchange methods depending on what the server supports for the same key, so this commit allows IPrivateKeySource to expose multiple key exchange methods for the same key and will try each one. Tested on Ubuntu 18.04 and 22.04 with default SSH server config and with only ssh-rsa and rsa-sha2-256 key exchange enabled.

johnliaoywl · 2022-12-07T08:44:58Z

Hi, I would like to know if there is any update for this one.

lcheng526 · 2023-01-24T03:32:20Z

when the library is going to upgrade to support sha-256 and sha-512?

lcheng526 · 2023-02-01T01:37:15Z

There doesn't appear to be any way to select different exchange methods depending on what the server supports for the same key, so this commit allows IPrivateKeySource to expose multiple key exchange methods for the same key and will try each one.

Tested on Ubuntu 18.04 and 22.04 with default SSH server config and with only ssh-rsa and rsa-sha2-256 key exchange enabled.

Not sure if this is necessarily the best design to go with, so haven't updated the tests yet.

A simpler approach would be to just replace ssh-rsa with rsa-sha2-256, which would prevent communication with old servers (OpenSSH 7.2 added rsa-sha2-256 support in 2016).

Based on @ml054's work in #825 (comment)

Does the solution works? I am getting "Key exchanger negotiation failed" exception. The code is never hitting RsaSha256DigitalSignature class. It always hitting RsaKey class. any reason for this?

maxx8888 · 2023-02-08T16:38:59Z

Same for me, does this solution work? Do i need to change used HMAC Algorithm somehow?

darkoperator · 2023-04-02T17:38:11Z

A lot of people are hitting this issue.

mikeblas · 2023-05-15T17:13:26Z

What is preventing this from being merged? Looks like lots of people (me, too!) have this issue: #825 and #956 for example.

ckdell · 2023-06-27T16:21:14Z

@mikeblas : The build failing is probably the #1 blocker here.

Videstra · 2023-07-03T12:00:30Z

Yeah - add me to the list of people having problems with this. The temp workaround is to add the following two lines to the end of the /etc/ssh/sshd_config file
HostKeyAlgorithms +ssh-rsa
PubkeyAcceptedKeyTypes +ssh-rsa
If you don't have access to edit that file you will need a different library. This appears to be specific to new versions of ubuntu that have deprecated the rsa keys...

et1975 · 2023-08-03T15:23:48Z

Is there an overlap with #1098? @drieseng Any blockers other than rebase to merging this?

et1975 · 2023-08-03T15:58:51Z

src/Renci.SshNet/IPrivateKeySource.cs

@@ -10,6 +10,6 @@ public interface IPrivateKeySource
        /// <summary>
        /// Gets the host key.
        /// </summary>
-        HostAlgorithm HostKey { get; }
+        HostAlgorithm[] HostKeys { get; }


This appears to be a pretty big change for the current codebase.

Any guidance @darinkes ?

phamvietdung · 2023-09-08T11:48:42Z

It's not working for me :((

Videstra · 2023-09-08T12:22:09Z

It's not working for me :((
If you have access to the server you need to add the following two lines to the end of the /etc/ssh/sshd_config file

HostKeyAlgorithms +ssh-rsa
PubkeyAcceptedKeyTypes +ssh-rsa

```If you don't have access to edit that file you will need a different library.

phamvietdung · 2023-09-08T12:29:05Z

It's not working for me :((
If you have access to the server you need to add the following two lines to the end of the /etc/ssh/sshd_config file
HostKeyAlgorithms +ssh-rsa
PubkeyAcceptedKeyTypes +ssh-rsa

```If you don't have access to edit that file you will need a different library. 

Thanks, but i dont want to change the /etc/ssh/sshd_config or maybe sometime i dont have permission to do this action.

WojciechNagorski · 2023-09-08T13:38:05Z

We will work on that in near future.

hhklmc · 2023-09-19T09:46:25Z

same issue here with Kernel version 5.10.50-linux4sam-2021.04+ whilst 4.9 can connect successfully.

WojciechNagorski · 2023-09-19T09:53:30Z

@hhklmc I've just finished the implementation of rsa-sha-256 here #1177

It would be great if you could confirm that the fix works so that we can release a new version this week.

hhklmc · 2023-09-19T11:44:55Z

@hhklmc I've just finished the implementation of rsa-sha-256 here #1177

It would be great if you could confirm that the fix works so that we can release a new version this week.

How can I test it, any pre-release package published to nuget or?

WojciechNagorski · 2023-09-19T11:54:53Z

Currently, we don't have pre-release packages (I know we should have them). The best option is to download the repo, checkout to the branch, add the project to the solution, and reference the project instead of Nuget. This is all for testing purposes only.

git clone https://github.com/Rob-Hague/SSH.NET.git
cd SSH.NET
git checkout rsa-sha2

hhklmc · 2023-09-20T11:12:23Z

Currently, we don't have pre-release packages (I know we should have them). The best option is to download the repo, checkout to the branch, add the project to the solution, and reference the project instead of Nuget. This is all for testing purposes only.
git clone https://github.com/Rob-Hague/SSH.NET.git
cd SSH.NET
git checkout rsa-sha2

I can confirm that rsa-sha2 branch now works for me. Thank you very much!

WojciechNagorski · 2023-09-20T11:50:45Z

@hhklmc big thanks for checking. Thanks to it we are closer to release. 😄

WojciechNagorski · 2023-09-23T08:34:21Z

Fixed by #1177 and #1180

WojciechNagorski · 2023-10-10T21:45:53Z

Version 2023.0.0 has been published https://www.nuget.org/packages/SSH.NET/2023.0.0

yoyo-danielc requested a review from drieseng as a code owner June 24, 2022 09:11

veochen-octopus mentioned this pull request Sep 9, 2022

Unable to connect to ubuntu 22.04 using ssh-rsa OctopusDeploy/Issues#7764

Closed

1 task

jcalla97 mentioned this pull request Nov 15, 2022

C# SSH.NET "ERROR: An established connection was aborted by the server" #1028

Open

ml054 mentioned this pull request Jan 30, 2023

Support for rsa-sha2-256 and rsa-sha2-512 #825

Closed

et1975 reviewed Aug 3, 2023

View reviewed changes

et1975 mentioned this pull request Aug 3, 2023

PR #971 with conflicts resolved and building #1156

Closed

Rob-Hague mentioned this pull request Sep 9, 2023

RSA SHA-2 implementation proposal #1174

Closed

WojciechNagorski added this to the 2023.0.0 milestone Sep 13, 2023

WojciechNagorski added the RSA SHA-2 label Sep 18, 2023

WojciechNagorski closed this Sep 23, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

WIP: Implement support for rsa-sha2-256 key exchange. #971

WIP: Implement support for rsa-sha2-256 key exchange. #971

yoyo-danielc commented Jun 24, 2022

johnliaoywl commented Dec 7, 2022

lcheng526 commented Jan 24, 2023

lcheng526 commented Feb 1, 2023 •

edited

Loading

maxx8888 commented Feb 8, 2023

darkoperator commented Apr 2, 2023

mikeblas commented May 15, 2023

ckdell commented Jun 27, 2023

Videstra commented Jul 3, 2023 •

edited

Loading

et1975 commented Aug 3, 2023

et1975 Aug 3, 2023

et1975 Aug 3, 2023

phamvietdung commented Sep 8, 2023

Videstra commented Sep 8, 2023

phamvietdung commented Sep 8, 2023 •

edited

Loading

WojciechNagorski commented Sep 8, 2023

hhklmc commented Sep 19, 2023

WojciechNagorski commented Sep 19, 2023

hhklmc commented Sep 19, 2023

WojciechNagorski commented Sep 19, 2023

hhklmc commented Sep 20, 2023

WojciechNagorski commented Sep 20, 2023

WojciechNagorski commented Sep 23, 2023

WojciechNagorski commented Oct 10, 2023

WIP: Implement support for rsa-sha2-256 key exchange. #971

WIP: Implement support for rsa-sha2-256 key exchange. #971

Conversation

yoyo-danielc commented Jun 24, 2022

johnliaoywl commented Dec 7, 2022

lcheng526 commented Jan 24, 2023

lcheng526 commented Feb 1, 2023 • edited Loading

maxx8888 commented Feb 8, 2023

darkoperator commented Apr 2, 2023

mikeblas commented May 15, 2023

ckdell commented Jun 27, 2023

Videstra commented Jul 3, 2023 • edited Loading

et1975 commented Aug 3, 2023

et1975 Aug 3, 2023

Choose a reason for hiding this comment

et1975 Aug 3, 2023

Choose a reason for hiding this comment

phamvietdung commented Sep 8, 2023

Videstra commented Sep 8, 2023

phamvietdung commented Sep 8, 2023 • edited Loading

WojciechNagorski commented Sep 8, 2023

hhklmc commented Sep 19, 2023

WojciechNagorski commented Sep 19, 2023

hhklmc commented Sep 19, 2023

WojciechNagorski commented Sep 19, 2023

hhklmc commented Sep 20, 2023

WojciechNagorski commented Sep 20, 2023

WojciechNagorski commented Sep 23, 2023

WojciechNagorski commented Oct 10, 2023

lcheng526 commented Feb 1, 2023 •

edited

Loading

Videstra commented Jul 3, 2023 •

edited

Loading

phamvietdung commented Sep 8, 2023 •

edited

Loading