accessing a fedora box (latest fedora 35) from Windows using PuTTY/WinSCP only possible with userid/password

[Walter H.]

Hello,

can someone please give me a hint, where to look for the following 
problem ...

I have several Linux VMs (all except this one are CentOS), and I took 
/root/.ssh/authorized_keys from one of them
and copied it onto this Fedora box;

accessing from my Jump-VM also directly using SSH from Win10 works fine 
using the private key,
but from when using PuTTY/WinSCP I get: "Server refused our key."
(all other Linux-VMs use the same authorized_keys and can be accessed 
using PuTTY/WinSCP with this private key)

is there something I must change on the side of the Fedora box or 
something I have to change in PuTTY/WinSCP?
(I'm using the latest releases of PuTTY/WinSCP)

Thanks,
Walter

[George N. White III]

On Sat, 20 Nov 2021 at 08:16, Walter H. via users <
users(a)lists.fedoraproject.org&gt; wrote:

>  Hello,
>
>  can someone please give me a hint, where to look for the following
>  problem ...
>
>  I have several Linux VMs (all except this one are CentOS), and I took
>  /root/.ssh/authorized_keys from one of them
>  and copied it onto this Fedora box;
>
>  accessing from my Jump-VM also directly using SSH from Win10 works fine
>  using the private key,
>  but from when using PuTTY/WinSCP I get: "Server refused our key."
>  (all other Linux-VMs use the same authorized_keys and can be accessed
>  using PuTTY/WinSCP with this private key)
>
>  is there something I must change on the side of the Fedora box or
>  something I have to change in PuTTY/WinSCP?
>  (I'm using the latest releases of PuTTY/WinSCP)
>  
Many enterprise policies prohibit ssh access for root, but if you aren't
worried about security risks, look in /etc/sshsshd_conf's Authentication
section for "PermitRootLogin":

# Authentication:
#LoginGraceTime 2m
PermitRootLogin yes
#StrictModes yes
#MaxAuthTries 6
#MaxSessions 10

The alternative is to log in as a regular user and use one of the
elevation methods (sudo, su) to gain root privileges.

-- 
George N. White III

[Walter H.]

On 20.11.2021 14:27, George N. White III wrote:
>  On Sat, 20 Nov 2021 at 08:16, Walter H. via users 
>  <users(a)lists.fedoraproject.org <mailto:[e-mail]>> 
>  wrote:
>
>      Hello,
>
>      can someone please give me a hint, where to look for the following
>      problem ...
>
>      I have several Linux VMs (all except this one are CentOS), and I took
>      /root/.ssh/authorized_keys from one of them
>      and copied it onto this Fedora box;
>
>      accessing from my Jump-VM also directly using SSH from Win10 works
>      fine
>      using the private key,
>      but from when using PuTTY/WinSCP I get: "Server refused our key."
>      (all other Linux-VMs use the same authorized_keys and can be accessed
>      using PuTTY/WinSCP with this private key)
>
>      is there something I must change on the side of the Fedora box or
>      something I have to change in PuTTY/WinSCP?
>      (I'm using the latest releases of PuTTY/WinSCP)
>
>
>  Many enterprise policies prohibit ssh access for root, but if you aren't
>  worried about security risks, look in /etc/sshsshd_conf's Authentication
>  section for "PermitRootLogin": 
PermitRootLogin is set to yes;

and the same Problem also exists with non root, too;

/var/log/secure shows this:

Nov 20 15:11:33 lxfedora sshd[2584]: userauth_pubkey: key type ssh-rsa 
not in PubkeyAcceptedAlgorithms [preauth]

so the question is:  what is the default value of this 
'PubkeyAcceptedAlgorithms', in order to set it to the default PLUS 
'ssh-rsa';

Thanks,
Walter

[Kevin Becker]

>  On Nov 20, 2021, at 9:24 AM, Walter H. via users
> <users(a)lists.fedoraproject.org&gt; wrote:
>  
>  /var/log/secure shows this:
>  Nov 20 15:11:33 lxfedora sshd[2584]: userauth_pubkey: key type ssh-rsa not in
> PubkeyAcceptedAlgorithms [preauth]
>  
>  so the question is:  what is the default value of this
> 'PubkeyAcceptedAlgorithms', in order to set it to the default PLUS
> 'ssh-rsa';
>  
>   
This is handled by the system-wide crypto policies.  I’m sure there is a way to create a
custom crypto policy to tweak this one parameter but I’ve never done it.  You can roll
everything back to LEGACY with

update-crypto-policies --set LEGACY

Or you can target a specifc older release:

update-crypto-policies --set DEFAULT:FEDORA32

To bring it back to the current default policy:

update-crypto-policies --set DEFAULT

However rather than change the policy on fedora, I think the recommendation would be to
regenerate your putty key with a stronger algorithm and/or key length and copy the new
public key to your other boxes.

[Markus Schönhaber]

20.11.21, 15:24 +0100, Walter H. via users:

>  Nov 20 15:11:33 lxfedora sshd[2584]: userauth_pubkey: key type
> ssh-rsa
>  not in PubkeyAcceptedAlgorithms [preauth]
>  
>  so the question is:  what is the default value of this
>  'PubkeyAcceptedAlgorithms', in order to set it to the default PLUS
>  'ssh-rsa'; 
I think (not tested) adding

PubkeyAcceptedAlgorithms +ssh-rsa

to sshd_config might resolve your problem.
Nevertheless you should take a look at sshd_config(5) (which, in the 
explanation for "PubkeyAcceptedAlgorithms", points at 
update-crypto-policies(8)).

AFAIUI the root source of the problem might be that your key uses a 
SHA-signature with a SHA-1 hash. Therefore, a better solution might be 
to generate a new key.

-- 
Regards
   mks

[Markus Schönhaber]

20.11.21, 16:13 +0100 Markus Schönhaber:

>  20.11.21, 15:24 +0100, Walter H. via users:
>  
> > Nov 20 15:11:33 lxfedora sshd[2584]: userauth_pubkey: key type ssh-rsa
> > not in PubkeyAcceptedAlgorithms [preauth]
> >
> > so the question is:  what is the default value of this
> > 'PubkeyAcceptedAlgorithms', in order to set it to the default PLUS
> > 'ssh-rsa';
>  
>  I think (not tested) adding
>  
>  PubkeyAcceptedAlgorithms +ssh-rsa
>  
>  to sshd_config might resolve your problem.
>  Nevertheless you should take a look at sshd_config(5) (which, in the
>  explanation for "PubkeyAcceptedAlgorithms", points at
>  update-crypto-policies(8)).
>  
>  AFAIUI the root source of the problem might be that your key uses a
>  SHA-signature with a SHA-1 hash. Therefore, a better solution might be
>  to generate a new key. 
Make that "RSA-signature with a SHA-1 hash", sorry.

-- 
Regards
   mks

[Walter H.]

On 20.11.2021 16:13, Markus Schönhaber wrote:
>  20.11.21, 15:24 +0100, Walter H. via users:
>
> > Nov 20 15:11:33 lxfedora sshd[2584]: userauth_pubkey: key type ssh-rsa
> > not in PubkeyAcceptedAlgorithms [preauth]
> >
> > so the question is:  what is the default value of this
> > 'PubkeyAcceptedAlgorithms', in order to set it to the default PLUS
> > 'ssh-rsa';
>
>  I think (not tested) adding
>
>  PubkeyAcceptedAlgorithms +ssh-rsa
>
>  to sshd_config might resolve your problem. 
yes, this solved the problem;
thanks;
>  AFAIUI the root source of the problem might be that your key uses a 
>  SHA-signature with a SHA-1 hash. Therefore, a better solution might be 
>  to generate a new key.
>  
that is right; the latest PuTTY is 0.76 and the latest WinSCP is 5.19.4;

I did this generated a new key with a SHA2 hash,
with PuTTY this worked, but not with WInSCP;

Walter

[Barry]

>  On 21 Nov 2021, at 08:26, Walter H. via users
> <users(a)lists.fedoraproject.org&gt; wrote:
>  
>  On 20.11.2021 16:13, Markus Schönhaber wrote:
> > 20.11.21, 15:24 +0100, Walter H. via users:
> > 
> >> Nov 20 15:11:33 lxfedora sshd[2584]: userauth_pubkey: key type ssh-rsa
> >> not in PubkeyAcceptedAlgorithms [preauth]
> >> 
> >> so the question is:  what is the default value of this
> >> 'PubkeyAcceptedAlgorithms', in order to set it to the default PLUS
> >> 'ssh-rsa';
> > 
> > I think (not tested) adding
> > 
> > PubkeyAcceptedAlgorithms +ssh-rsa
> > 
> > to sshd_config might resolve your problem.
>  yes, this solved the problem;
>  thanks;
> > 
> > AFAIUI the root source of the problem might be that your key uses a SHA-signature
> with a SHA-1 hash. Therefore, a better solution might be to generate a new key.
> > 
>  that is right; the latest PuTTY is 0.76 and the latest WinSCP is 5.19.4;
>  
>  I did this generated a new key with a SHA2 hash,
>  with PuTTY this worked, but not with WInSCP; 
Is winscp using the new key?
If you are happy using the command line and if you have windows 10
the you can use Microsoft ssh and scp from command or the new terminal app - free from the
App Store.

Barry

>  
>  Walter
>  
>  
>  _______________________________________________
>  users mailing list -- users(a)lists.fedoraproject.org
>  To unsubscribe send an email to users-leave(a)lists.fedoraproject.org
>  Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  List Archives:
> https://lists.fedoraproject.org/archives/list/[e-mail]
>  Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure