Question about ssh-rsa deprecation about jsch HOT 5 CLOSED

Hi @austinarbor,

The ssh -Q sig command is not meant to indicate what signature algorithms are currently enabled by the sshd_config or ssh_config, but rather is intended to simply indicate all the possible algorithms that ssh could possibly support, if adequately configured.

Thanks,
Jeremy

from jsch.

@norrisjeremy thanks for your response! do you know why removing ssh-rsa from the sshd_config also makes the rsa-sha2-256 and rsa-sha2-512 tests fail?

from jsch.

Hi @austinarbor,

The version of OpenSSH that is used for that particular integration test is an old release does not allow disabling just ssh-rsa whilst still keeping rsa-sha2-512 and/or rsa-sha2-256 enabled.
If you want to accomplish that, you would need to switch to a newer version of OpenSSH for that integration test.

Thanks,
Jeremy

from jsch.

Can confirm that if I replace alpine 3.7 with 3.19 (latest), the rsa 256/512 algorithms work with ssh-rsa removed from the config. thank you!

from jsch.

No need for guesswork. Audit the SSH client and server and compare the lists.

from jsch.