ssh-agent not working after upgrade to fedora 23

[Richard Heck]

I've googled around for this and found some similar complaints, but none
of the solutions mentioned in these threads works for me. So I'm asking
here.

With F22 on the same machine, my normal routine would be:

>  ssh-add 
Enter passphrase for /home/me/.ssh/id_dsa:
Identity added: /home/me/.ssh/id_dsa (/home/me/.ssh/id_dsa)
>  ssh myserver.com 
But now I get in response:

Enter passphrase for /home/me/.ssh/id_dsa:

And yet:

>  ssh-add -L 
ssh-dss
lots of stuff.... /home/me/.ssh/id_dsa

It seems that the agent is not being consulted or something.

I've check $SSH_AUTH_SOCK, and it seems to point to something reasonable:

>  echo $SSH_AUTH_SOCK 
/tmp/ssh-8mkcEDB8W6mO/agent.1158
>  ll /tmp/ssh-8mkcEDB8W6mO/agent.1158 
srw-------. 1 me me 0 Apr
13 15:36 /tmp/ssh-8mkcEDB8W6mO/agent.1158

Any suggestions?

Richard

[Tom Horsley]

On Wed, 13 Apr 2016 15:51:31 -0400
Richard Heck wrote:

>  Any suggestions? 
Yep. The security geeks decided dsa keys weren't secure,
but none of the errors messages you get give you a hint
that dsa keys no longer work.

You can change a lot of obscure parameters in /etc/sshd.config
(and maybe /etc/ssh.config as well) or you can sigh and
generate new keys using an "acceptable" cipher and
distribute the new public key around to every single
system that has your old dsa key.

[Gordon Messmer]

On 04/13/2016 01:04 PM, Tom Horsley wrote:
>  The security geeks decided dsa keys weren't secure 
Do you mean "the security experts who maintain OpenSSH and OpenBSD?"

http://www.openssh.com/txt/release-7.0

But, yeah, the release notes are light on details.

I recommend this document to SSH users:
https://wiki.mozilla.org/Security/Guidelines/OpenSSH

[Rick Stevens]

On 04/13/2016 01:04 PM, Tom Horsley wrote:
>  On Wed, 13 Apr 2016 15:51:31 -0400
>  Richard Heck wrote:
>
> > Any suggestions?
>
>  Yep. The security geeks decided dsa keys weren't secure,
>  but none of the errors messages you get give you a hint
>  that dsa keys no longer work.
>
>  You can change a lot of obscure parameters in /etc/sshd.config
>  (and maybe /etc/ssh.config as well) or you can sigh and
>  generate new keys using an "acceptable" cipher and
>  distribute the new public key around to every single
>  system that has your old dsa key. 
You can use "ssh -o HostkeyAlgorithms +ssh-dss remotehost" to
temporarily use dsa keys, or add

	Host *
	    HostkeyAlgorithms +ssh-dss

to your /etc/ssh/ssh_config or ~/.ssh/config file, but switch to rsa
when you can. The "experts" think its better and by default, ssh won't
use dss any more.

Also be aware that by default ssh no longer allows 
diffie-hellman-group1-sha1 key exchange.

Again, you can "ssh -o KexAlgorithms +diffie-hellman-group1-sha1 
remotehost" or add

	Host *
	    KexAlgorithms +diffie-hellman-group1-sha

to your /etc/ssh/ssh_config or ~/.ssh/config files. Both of these have
gotten me trying to log into some older Cisco routers. I've added things
like

	Host remote-cisco-gear
	    HostkeyAlgorithms +ssh-dss
	    KexAlgorithms +diffie-hellman-group1-sha1

for each of these problematic machines to my ~/.ssh/config file to get
around these issues. Grrrr!
----------------------------------------------------------------------
- Rick Stevens, Systems Engineer, AllDigital    ricks(a)alldigital.com -
- AIM/Skype: therps2        ICQ: 226437340           Yahoo: origrps2 -
-                                                                    -
-  Time: Nature's way of keeping everything from happening at once.  -
----------------------------------------------------------------------

[Richard Heck]

On 04/13/2016 05:39 PM, Rick Stevens wrote:
>  On 04/13/2016 01:04 PM, Tom Horsley wrote:
> > On Wed, 13 Apr 2016 15:51:31 -0400
> > Richard Heck wrote:
> >
> >> Any suggestions?
> >
> > Yep. The security geeks decided dsa keys weren't secure,
> > but none of the errors messages you get give you a hint
> > that dsa keys no longer work.
> >
> > You can change a lot of obscure parameters in /etc/sshd.config
> > (and maybe /etc/ssh.config as well) or you can sigh and
> > generate new keys using an "acceptable" cipher and
> > distribute the new public key around to every single
> > system that has your old dsa key.
>
>  You can use "ssh -o HostkeyAlgorithms +ssh-dss remotehost" to
>  temporarily use dsa keys, or add
>
>      Host *
>          HostkeyAlgorithms +ssh-dss
>
>  to your /etc/ssh/ssh_config or ~/.ssh/config file, but switch to rsa
>  when you can. The "experts" think its better and by default, ssh won't
>  use dss any more.
>
>  Also be aware that by default ssh no longer allows
>  diffie-hellman-group1-sha1 key exchange.
>
>  Again, you can "ssh -o KexAlgorithms +diffie-hellman-group1-sha1
>  remotehost" or add
>
>      Host *
>          KexAlgorithms +diffie-hellman-group1-sha
>
>  to your /etc/ssh/ssh_config or ~/.ssh/config files. Both of these have
>  gotten me trying to log into some older Cisco routers. I've added things
>  like
>
>      Host remote-cisco-gear
>          HostkeyAlgorithms +ssh-dss
>          KexAlgorithms +diffie-hellman-group1-sha1
>
>  for each of these problematic machines to my ~/.ssh/config file to get
>  around these issues. Grrrr! 
Thanks for the detailed suggestions. The weird thing was that, after I
entered the
passphrase, it WOULD let me connect. And adding the various lines to
.ssh/config,
etc, didn't help with that problem. But using new RSA keys solves it.

Richard