m10k4 (m10k4) asked a question.
Kali Linux support / Isn't the ssh-rsa signature algorithm a bad idea?
I see in this page (https://help.okta.com/en/prod/Content/Topics/Adv_Server_Access/docs/supported-os.htm) that Kali Linux isn't listed. I tried it anyway and am encountering the following error from the sft client:
error: ssh: handshake failed: ssh: unable to authenticate, attempted methods [none publickey], no supported methods remain
ssh_exchange_identification: Connection closed by remote host
The Kali host's /var/log/auth.log has:
Aug 10 14:25:45 ip-10-10-2-182 sshd[7484]: userauth_pubkey: certificate signature algorithm ssh-rsa: signature algorithm not supported [preauth]
Aug 10 14:25:45 ip-10-10-2-182 sshd[7484]: Connection closed by authenticating user <my_sft_user_name> 10.10.1.102 port 46894 [preauth]
So, is it possible to configure the Kali SSH daemon to allow connections or would it be better to force the server/agent relationship to abandon the soon-to-be deprecated SHA-1 option?
I'm in favor of the latter but haven't been able to figure out how to force the sft client to honor the HostKeyAlgorithms list in my .ssh/config that omits the ssh-rsa option.
Hi,
Liviu here from Okta Support.
We would suggest to force the server/agent relationship to abandon the soon-to-be deprecated SHA-1 option, but for further assistance and troubleshooting I recommend opening a support ticket.
Thank you,
Liviu Scarlat
Technical Support Engineer
Okta Global Customer Care
Mea culpa. I meant to come back to this question with the answer Okta Support provided but never got around to it.
Fix (until SHA-1 is removed):
Add `CASignatureAlgorithms ssh-rsa` to the system-wide sshd_config (/etc/ssh/sshd_config usually) and restart sshd.