Call for testing: OpenSSH 8.5
Darren Tucker
dtucker at dtucker.net
Thu Feb 25 00:51:36 AEDT 2021
On Wed, 24 Feb 2021 at 11:16, Phil Pennock <phil.pennock at globnix.org> wrote:
> # /etc/ssh/sshd_config:
> PubkeyAcceptedAlgorithms -ssh-rsa,-ssh-rsa-cert-*,-rsa*
"If the specified list begins with a '-' character, then the
specified key types (including wildcards)will be removed from the
default set instead of replacing them."
Only the first "-" indicates the specified patterns are to be removed,
the other ones form part of the patterns and thus don't match any
algorithms. You probably want something like:
$ sudo ./sshd -T -o 'PubkeyAcceptedAlgorithms
-ssh-rsa,ssh-rsa-cert-*,rsa*' | grep -i PubkeyAcceptedAlgorithms
pubkeyacceptedalgorithms
ssh-ed25519-cert-v01 at openssh.com,ecdsa-sha2-nistp256-cert-v01 at openssh.com,ecdsa-sha2-nistp384-cert-v01 at openssh.com,ecdsa-sha2-nistp521-cert-v01 at openssh.com,sk-ssh-ed25519-cert-v01 at openssh.com,sk-ecdsa-sha2-nistp256-cert-v01 at openssh.com,ssh-ed25519,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,sk-ssh-ed25519 at openssh.com,sk-ecdsa-sha2-nistp256 at openssh.com
--
Darren Tucker (dtucker at dtucker.net)
GPG key 11EAA6FA / A86E 3E07 5B19 5880 E860 37F4 9357 ECEF 11EA A6FA (new)
Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.
More information about the openssh-unix-dev
mailing list