3

I'm not able to login to Ubuntu 22.04 which I newly installed from MacOS terminal.

Here is the error I get while trying to SSH to ubuntu

QWERTY-M-91FL:~ qwerty$ ssh mnbv@16.67.45.123
Unable to negotiate with 16.67.45.123 port 22: no matching host key type found. Their offer: rsa-sha2-512,rsa-sha2-256,ecdsa-sha2-nistp256,ssh-ed25519
mac
  • 133
  • 1
  • 4

2 Answers2

4

This error is caused by the server and the client not having a common accepted type of host key. Most probably this is caused by a new SSH server version and an old SSH client version. Ubuntu 22.04 bundles with OpenSSH 8.9, while ssh-rsa (the most used key type) has been disabled since OpenSSH 8.8. From the release notes:

This release disables RSA signatures using the SHA-1 hash algorithm by default. This change has been made as the SHA-1 hash algorithm is cryptographically broken, and it is possible to create chosen-prefix hash collisions for <USD$50K 1

The best approach would be to update your ssh client version. Seriously. It might be an easy approach to change the server's settings, but as stated by the OpenSSH developers, hash collisions are very easily found for older ssh-rsa, which could completely break your security and allow for man-in-the-middle attacks.


Another approach is to tell the server to generate older host key types (manual).

  1. Get a list of all supported host key types on the client:

    mtak@client:~$ ssh -Q sig
    ssh-ed25519
    sk-ssh-ed25519@openssh.com
    ssh-rsa
    rsa-sha2-256
    rsa-sha2-512
    ssh-dss
    ecdsa-sha2-nistp256
    ecdsa-sha2-nistp384
    ecdsa-sha2-nistp521
    sk-ecdsa-sha2-nistp256@openssh.com
    
  2. Pick a supported host key (signature) type and add that to the HostkeyAlgorithms list on the server:

    In /etc/ssh/sshd_config, add and/or set:

    HostkeyAlgorithms ssh-rsa
    

    (note that I haven't tested this. I don't have an SSH client old enough to run into this issue)

mtak
  • 16,513
  • 2
  • 52
  • 64
0

Note that you encounter this error due to old host key algoriths being disabled. So be warned as you proceed:

You can override the host key algorithm using

ssh -oHostKeyAlgorithms=+rsa-sha2-512 mnbv@16.67.45.123
Kristian
  • 290
  • 1
  • 3
  • 15