signmykeyio/signmykey

Problem will trying to authenticate to Ubuntu 20.04

HammerZ3it opened this issue · 5 comments

HammerZ3it commented

As mentioned in the title, there is a problem when we try to authenticate any OpenSSH Server on a Ubuntu 20.04 release.
This is due to OpenSSH 8.2 which do not support SHA-1 based RSA certificate algorithm anymore as they no longer considered it secure.

Logs :
userauth_pubkey: certificate signature algorithm ssh-rsa: signature algorithm not supported [preauth]

There is an actual workaround :
Add this to you sshd_config on the server side :
CASignatureAlgorithms ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa

It is something I will not personally do as if it is disable by default, I'd rather follow the recommendation.

https://man.openbsd.org/sshd_config#CASignatureAlgorithms

Thing is that it is not necessary to generate a new CA.
We only need to generate a new certificat with the option -t of ssh-keygen command.
ssh-keygen ... -t rsa-sha2-256 id_rsa.pub

This will likely resolve this issue but it seems it not have backwards compatibility.
sha2 is not available on all Open-SSH server versions.

Regards,

c35sys commented

This issue will normally be corrected in Vault 1.4.3, patch has been merged to introduce a new signing algorithm option

see: hashicorp/vault#9096

Note that Vault 1.4.3 is not released yet.

c35sys commented

Vault 1.4.3 is out and everything is working with the new algorithm_signer option.

However you can't use the webUI to update the role, you need to use command line:

echo '{
  "algorithm_signer": "rsa-sha2-256",
  "allow_user_certificates": true,
  "allowed_users": "*",
  "allow_user_key_ids": true,
  "default_extensions": [
    {
      "permit-pty": ""
    }
  ],
  "key_type": "ca",
  "default_user": "root",
  "max_ttl": "12h" ,
  "ttl": "30m"
}' > sign-user-role.json

vault write ssh/roles/sign-user-role @sign-user-role.json
HammerZ3it commented

Made the update 1.4.3 and even 1.5.0 but it seems there is a problem with my set up.
I can't find the "algorithm_signer" key when I read the role :

vault read ssh/roles/sign-user-role

Will try to find the issue

c35sys commented

Using 1.4.3, I'm able to retrieve the option using

vault read -field=algorithm_signer ssh/roles/sign-user-role

and the output is:

rsa-sha2-256
HammerZ3it commented

Seems that there was an issue with consul as a backend, I had to restart the service for the field to appear.
Thx for your help @c35sys .

Regards.

PS : Solved in 1.4.3 and 1.5.0 tested both.

  • 👍2