mainSavannah Administration - Support: sr #110996, Can't ssh to fencepost.gnu.org

 
 

sr #110996: Can't ssh to fencepost.gnu.org

Submitter:  Kyra <kxra>
Submitted:  Sat 30 Dec 2023 01:25:16 AM UTC
   
 
Category:  None Priority:  5 - Normal
Severity:  3 - Normal Status:  None
Privacy:  Public Assigned to:  rwp
Operating System:  None Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup
   

Sun 31 Dec 2023 02:28:53 AM UTC, comment #4: 

I had a friend test from his Fedora Silverblue system and without any
local host keys everything works.  But if he includes the old 1024-bit
host key in known_hosts then the problem as you report is reproduced
exactly.  As I understand it this issue is still open in Fedora being
tracked by this bug ticket.

https://bugzilla.redhat.com/show_bug.cgi?id=2164016

Please double check that there still is not a host key entry hiding in
your ~/.ssh/known_hosts file and not in any /etc/ssh/ssh_known_hosts
files either.  That should avoid the problem.

If not then I would try adding in an explicit host key of the correct
type.


fencepost.gnu.org ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMs/YsLN74Zz7DuIyzOodqzbryG9cS0hlhjw9MJwcOk1


Bob Proulx <rwp>
Site Administrator
Sat 30 Dec 2023 10:19:28 PM UTC, comment #3: 

comment #2:

> Are you running Arch or Parabola and if so have you recently updated
> to a newer version of ssh?  This is me guessing and gathering
> background information.
>
> The problem is most likely that the ssh client on your system is
> rejecting the legacy 1024-bit rsa host key being presented by
> fencepost and not trying either of the other two presented newer host
> keys which are stronger.



I use Fedora Silverblue v39, but still may be the same problem

> In the meantime let's see if we can help.  As a temporary workaround I
> think this next will force your ssh client to acept the key but to
> upgrade to the strongest ED25519 key and store it into the known_hosts
> file.
>
> Try this:
>


>     ssh -o'UpdateHostKeys=yes' -o'HostkeyAlgorithms=+ssh-rsa' -o'PubkeyAcceptedAlgorithms=+ssh-rsa' fencepost.gnu.org
>     ...
>     ED25519 key fingerprint is SHA256:czIgr7VZvWzBireMUixS42C5dnq/H5DaRAbTD2Kgqpw.
>     ...


Really appreciate the assistance, but unfortunately that gives me the exact same `Bad server host key: Invalid key length` with exit code 255.

> If that works, allows you to accept the new key, and log into
> fencepost, then on your client create an ed25519 key, and upgrade the
> public key in your fencepost ~/.ssh/authorized_keys file to the
> contents of the newly created id_ed25519.pub file on your client.
> This is described somewhat more here for Savannah.
>
> https://savannah.nongnu.org/maintenance/SshAccess/
>
> Then also log into your Savannah web UI and upgrade your access keys
> for use with Savannah systems as this would likely be a problem for
> any ssh access there too.
>
> I appreciate hearing feedback about these instructions.  If they work.
> If they don't work.  If they were confusing.  If they were clear.  We
> want to be able to help people with the best information possible.


Instructions are clear and I do have an ed25519 and rsa key which have both been uploaded to Savannah, but perhaps I have to reach out to the FSF admin about that once I get this connection working.

Kyra <kxra>
Sat 30 Dec 2023 05:48:58 PM UTC, comment #2: 

Are you running Arch or Parabola and if so have you recently updated
to a newer version of ssh?  This is me guessing and gathering
background information.

The problem is most likely that the ssh client on your system is
rejecting the legacy 1024-bit rsa host key being presented by
fencepost and not trying either of the other two presented newer host
keys which are stronger.

I suggest fixing this with the end goal of upgrading to using ED25519
keys instead of the previous RSA keys.  ED25519 keys are stronger,
more compact, and use different algorithms which causes ssh to avoid
looking at the RSA key at all.  It's one of those win-win upgrades.

However it's a circular dependency.  You can't change your key in the
~/.ssh/authorized_keys file without being able to log in and you can't
log in.  Therefore the first step is to provide a temporary workaround
for the host key rejection so that you can log in.  Then upgrade your
identity keys to ed25519 keys.  At that point you should be good to
go.

Note though that you have filed your bug ticket against Savannah
fencepost is not part of the Savannah software forge and we here don't
have admin access to fencepost.  Meaning I think what I describe is
the problem but if this does not work then you will have to file a
ticket with FSF sysadmin who controls and admins the fencepost
machine.

In the meantime let's see if we can help.  As a temporary workaround I
think this next will force your ssh client to acept the key but to
upgrade to the strongest ED25519 key and store it into the known_hosts
file.

Try this:


    ssh -o'UpdateHostKeys=yes' -o'HostkeyAlgorithms=+ssh-rsa' -o'PubkeyAcceptedAlgorithms=+ssh-rsa' fencepost.gnu.org
    ...
    ED25519 key fingerprint is SHA256:czIgr7VZvWzBireMUixS42C5dnq/H5DaRAbTD2Kgqpw.
    ...


If that works, allows you to accept the new key, and log into
fencepost, then on your client create an ed25519 key, and upgrade the
public key in your fencepost ~/.ssh/authorized_keys file to the
contents of the newly created id_ed25519.pub file on your client.
This is described somewhat more here for Savannah.

https://savannah.nongnu.org/maintenance/SshAccess/

Then also log into your Savannah web UI and upgrade your access keys
for use with Savannah systems as this would likely be a problem for
any ssh access there too.

I appreciate hearing feedback about these instructions.  If they work.
If they don't work.  If they were confusing.  If they were clear.  We
want to be able to help people with the best information possible.
Thanks!

Hopefully this will get you going!

Bob Proulx <rwp>
Site Administrator
Sat 30 Dec 2023 05:10:22 PM UTC, comment #1: 

TTBOMK fencepost and Savannah keys aren't synchronized automatically, see savannah.nongnu.org/maintenance/NotSavannahAdmins/ and www.gnu.org/software/README.accounts.html

Ineiev <ineiev>
Site Administrator
Sat 30 Dec 2023 01:25:16 AM UTC, original submission:  

I'm trying to reconfigure my @gnu.org email address, but am unable to login to fencepost.

I have tried removing all entires for fencepost.gnu.org from my known_hosts file, but I get the following error when attempting to log in (I have added my public keys to savanah and also tried manually specifying them with the ssh -i flag):
Bad server host key: Invalid key length

Kyra <kxra>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by rwp (Posted a comment)
  • -email is unavailable- added by ineiev (Posted a comment)
  • -email is unavailable- added by kxra (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 2 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2023-12-30 rwp Assigned toNone rwp
        Open/ClosedOpen Closed

    Back to the top

    Powered by Savane 3.13-04b1.
    Corresponding source code