tg123/sshpiper

Public Key Auth fails with MacOS Ventura

developedsoftware opened this issue · 10 comments

developedsoftware commented

https://superuser.com/questions/1749364/git-ssh-permission-denied-in-macos-13-ventura

I am using v0 of the software (v1 doesnt work for our needs at the moment)

Would you expect OpenSSL issues with Ventura?

macOS 13 (Ventura) ships with OpenSSH_9.0p1. According to the OpenSSH release notes:

This release disables RSA signatures using the SHA-1 hash algorithm by default. This change has been made as the SHA-1 hash algorithm is cryptographically broken, and it is possible to create chosen-prefix hash collisions for <USD$50K [1]

Is there any way of fixing it? I assume its something to do with the key exchange (man in the middle)

The same key under Ventura seems to work on other servers (linux out of the box). But it fails on sshpiper.

tg123 commented

sshpiper supports ed25519
you can set with -i

I will make sshpiper default key to ed25519

developedsoftware commented

I am running it from a docker container. So do I just need to change

CMD ["/sshpiperd" "daemon"] to CMD ["/sshpiperd" "-i" "daemon"]

Or can I enable ed25519 via /etc/ssh/sshd_config?

This is the image we are currently using https://hub.docker.com/layers/farmer1992/sshpiperd/v0.7.42/images/sha256-820ac13d806c89f77e17978c797b20058dc455eeb60cd3486e689929c1824819?context=explore

tg123 commented

sshpiperd -i /path/to/ssh_host_ed25519_key

developedsoftware commented

Thanks, can you confirm this will work in v0.7.42 (I appreciate its 6 months old)

developedsoftware commented

Can the path to the ed25519_key be set in the sshd_config like every other parameter?

tg123 commented

you do not have to change anything in sshd as it is behind the sshpiper
ssh will not know what algo sshd is using

developedsoftware commented

Ok I think I might be getting confused in that case.

Is the issue with the key on the sshpiper service or on the client ?

Apologises if I am getting confused. I am not sure how I’d fix this via a docker container….

tg123 commented

the sshpiper by default is using rsa which is deprecated in newer openssh client (>8.6 maybe)

  • 👍1
developedsoftware commented

Thanks. For anybody else I got this working again in Docker by changing

-v /etc/ssh/ssh_host_rsa_key:/etc/ssh/ssh_host_rsa_key

to

-v /etc/ssh/ssh_host_rsa_key:/etc/ssh/ssh_host_dsa_key:ro \
-v /etc/ssh/ssh_host_ed25519_key:/etc/ssh/ssh_host_ed25519_key:ro \
-v /etc/ssh/ssh_host_ecdsa_key:/etc/ssh/ssh_host_ecdsa_key:ro \
-v /etc/ssh/ssh_host_rsa_key:/etc/ssh/ssh_host_rsa_key:ro \

And SSHPiper started working again.

Do you want me to close this issue or keep it open until the fix is implemented?

tg123 commented

thanks
i will close it after default to ed25519

  • 👍1