Ssh on Kiril Vladimirov https://vld.bg/tags/ssh/ Recent content in Ssh on Kiril Vladimirov Hugo -- 0.168.0 en Authorize SSH keys https://vld.bg/tips/ssh-keys/ Mon, 01 Jan 0001 00:00:00 +0000 https://vld.bg/tips/ssh-keys/ <p>How often have you asked or have been asked to provide public SSH keys in order to get authorized into given server or Git repository? I&rsquo;ve heard horror stories of people providing private keys, by mistake. GitHub and GitLab ease this process greatly, but are not advertising it well enough.</p> <p>You can append <code>.keys</code> to the URL of your profile in order to receive the public keys you have on your account in a format to directly pipe it into <code>~/.ssh/authorized_keys</code>:</p> How often have you asked or have been asked to provide public SSH keys in order to get authorized into given server or Git repository? I’ve heard horror stories of people providing private keys, by mistake. GitHub and GitLab ease this process greatly, but are not advertising it well enough.

You can append .keys to the URL of your profile in order to receive the public keys you have on your account in a format to directly pipe it into ~/.ssh/authorized_keys:

curl https://github.com/<username>.keys | tee -a ~/.ssh/authorized_keys

Same goes for any GitLab instance.

]]> SSH into an ancient machine https://vld.bg/tips/anctient-ssh/ Mon, 01 Jan 0001 00:00:00 +0000 https://vld.bg/tips/anctient-ssh/ <p>TL;DR: <code>ssh -oHostKeyAlgorithms=+ssh-rsa -oRequiredRSASize=1024 &lt;user&gt;@&lt;host&gt;</code></p> <p>Have you ever tried to SSH into an old machine, say a managed switch, UPS or router from the previous decade only to get declined with the following error:</p> <div class="highlight"><pre tabindex="0" style="color:#d0d0d0;background-color:#202020;-moz-tab-size:4;-o-tab-size:4;tab-size:4;-webkit-text-size-adjust:none;"><code class="language-txt" data-lang="txt"><span style="display:flex;"><span>Unable to negotiate with &lt;host&gt;: no matching host key type found. </span></span><span style="display:flex;"><span>Their offer: ssh-rsa,ssh-dss </span></span></code></pre></div><p>It&rsquo;s frustrating, isn&rsquo;t it? OpenSSH implements all of the cryptographic algorithms needed for compatibility with standards-compliant SSH implementations, but since some of the older algorithms have been found to be weak, not all of them are enabled by default. If you want to learn more about it, definitely should read <a href="https://www.openssh.com/legacy.html" target="_blank">OpenSSH Legacy Options</a> .</p> TL;DR: ssh -oHostKeyAlgorithms=+ssh-rsa -oRequiredRSASize=1024 <user>@<host>

Have you ever tried to SSH into an old machine, say a managed switch, UPS or router from the previous decade only to get declined with the following error:

Unable to negotiate with <host>: no matching host key type found.
Their offer: ssh-rsa,ssh-dss

It’s frustrating, isn’t it? OpenSSH implements all of the cryptographic algorithms needed for compatibility with standards-compliant SSH implementations, but since some of the older algorithms have been found to be weak, not all of them are enabled by default. If you want to learn more about it, definitely should read OpenSSH Legacy Options .

But this is a tip, so the short story is that you should use one of offered algorithms by the server, say -oHostKeyAlgorithms=+ssh-rsa. When it comes to ssh-rsa, however that won’t be enough and you would be challenged with another error:

Bad server host key: Invalid key length

The crypto-policy that comes with modern distributions does not allow RSA key sizes < 2048 bit. Some SSH servers are configured with 1024-bit key sizes that can lead to connection failures. -oRequiredRSASize=1024 overrides that default and Voilà.

]]>