[SSHD-1141] Implement server-sig-algs

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 2.7.0
• Assignee: Thomas Wolf
• Reporter: Ian Wienand
• Created: 12/Mar/21 03:22
• Updated: 20/Dec/21 08:50
• Resolved: 08/Apr/21 10:51

Description

Mina sshd should implement server-sig-algs to report signature algorithms.

Without the daemon sending server-sig-algs, clients fall back to ssh-rsa per RFC8332

When authenticating with an RSA key against a server that does not implement the "server-sig-algs" extension, clients MAY default to an "ssh-rsa" signature to avoid authentication penalties.

Some distributions, notably Fedora 33, have set default system policy to disallow insecure algorithms such as ssh-rsa.  They thus can not find a suitable signature algorithm and fail to log in.  Quite a high level of knowledge is required to override the default system cryptography policy, and it can be quite confusing because the user's ssh-key works in many other contexts (against openssh servers, etc.).  For full details see discussion in SSHD-1118.

For example, connecting to a recent openssh server I see something like

debug1: kex_input_ext_info: server-sig-algs=<ssh-ed25519,[e-mail],ssh-rsa,rsa-sha2-256,rsa-sha2-512,ssh-dss,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,[e-mail]>

I believe that Mina SSHD does support these more secure signature algorithms, but because they aren't reported the client won't use them.

Issue Links

• fixes: SSHD-1118 Unable to connect with Fedora 33 which has dropped ssh-rsa from PubkeyAcceptedKeyTypes
• is duplicated by: SSHD-1154 userauth_pubkey: unsupported public key algorithm: rsa-sha2-512