Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

SFTP rsa-sha2-256, rsa-sha2-512 key exchange issue #10143

Closed
norbertmm opened this issue Dec 22, 2022 · 6 comments
Closed

SFTP rsa-sha2-256, rsa-sha2-512 key exchange issue #10143

norbertmm opened this issue Dec 22, 2022 · 6 comments
Labels
SCP/SFTP

Comments

@norbertmm
Copy link

Compiled and linked curl to libssh2 current github master dev branch in order to get rsa-sha2-256 and rsa-sha2-512 server-key-exchange methods.

First SSH server connect works fine, server key gets saved to ssh local keyfile. Subsequent connects failing always because curl offers only "ssh-rsa", not "rsa-sha2-256" and "rsa-sha2-512" anymore, to server.

Could fix the issue with a little change to /lib/vssh/libssh2.c :
In ssh_force_knownhost_key_type()
static const char * const hostkey_method_ssh_rsa = "rsa-sha2-256,rsa-sha2-512,ssh-rsa";
instead of
static const char * const hostkey_method_ssh_rsa = "ssh-rsa";

This is the debug output when SFTP/SSH connect fails:
* Connected to 10.45.120.110 (10.45.120.110) port 22 (#0)
* Found host 10.45.120.110 in my_ssh_known_hosts.txt
* Set "ssh-rsa" as SSH hostkey type
* Failure establishing ssh session: -5, Unable to exchange encryption keys
* Closing connection 0

I think as soon a new libssh2 release is available (1.11.0), someone needs to address this issue in order to get rsa-sha2-256 and rsa-sha2-512. The old ssh-rsa (SHA1) is disabled within OpenSSH since version 8.8, 2021-09-26.
@bagder
Copy link
Member

bagder commented Dec 22, 2022

Could fix the issue with a little change to /lib/vssh/libssh2.c

The question is probably what the condition should be for using the updated string? Can we detect its presence in a better way than checking for the libssh2 version?

@norbertmm
Copy link
Author

norbertmm commented Dec 22, 2022 •
edited

The string with methods is used in a call to libssh2_session_method_pref() which removes all unsupported methods.
First I thought it would be necessary to detect which method of the three to methods to use/prefer (by store key length or so) -- but it turned to not to be necessary. It just works magically.
If you have, for example, a rsa-sha2-512 key locally stored, you might call libssh2_session_method_pref("rsa-sha2-256") and it works. No idea why.

@bagder
Copy link
Member

bagder commented Dec 22, 2022

@norbertmm you up for writing a PR for this perhaps?

@norbertmm
Copy link
Author

never done this ...

bagder added a commit that referenced this issue Dec 22, 2022
@bagder
libssh2: try sha2 algos for hostkey methods
5e57450 
As is supported by recent libssh2, but should just be ignored by older
versions.

Reported-by: norbertmm on github
Fixes #10143
@bagder bagder mentioned this issue Dec 22, 2022
Closed
@bagder
Copy link
Member

bagder commented Dec 22, 2022

@norbertmm Is #10145 what you had in mind? I admit I have not really read up on the subtleties involved here.

@norbertmm
Copy link
Author

@bagder Yes, that's right.
Perhaps it should be mentioned, that this fix is required to make CURLOPT_SSH_KNOWNHOSTS option work -- which is of course a good idea. Practically every SSH client is using such 'known-hosts file' mechanism. Otherwise you would have no server validation at all. CURLOPT_SSH_KNOWNHOSTS

bagder added a commit that referenced this issue Dec 25, 2022
@bagder
libssh2: try sha2 algos for hostkey methods
fd17a87 
As is supported by recent libssh2, but should just be ignored by older
versions.

Reported-by: norbertmm on github
Assisted-by: norbertmm on github
Fixes #10143
Closes #10154
@bagder bagder closed this as completed in ccf1ca9 Dec 26, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
SCP/SFTP
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

libssh2: try sha2 algos for hostkey methods curl/curl
2 participants
@bagder @norbertmm