[Bug 2059367] Re: SSH-RSA not supported for Self-SSH in Ubuntu 22.04 FIPS

Mon Apr 8 08:53:10 UTC 2024

Hi João, we are installing FIPS packages by using the Pro token.

PFB, the detailed debug logs of the SSH connection

ssh -vv onprem_shell at 10.14.169.25
OpenSSH_8.9p1 Ubuntu-3ubuntu0.6+Fips1, OpenSSL 3.0.2 15 Mar 2022
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: include /etc/ssh/ssh_config.d/*.conf matched no files
debug1: /etc/ssh/ssh_config line 21: Applying options for *
debug2: resolve_canonicalize: hostname 10.14.169.25 is address
debug1: FIPS mode initialized
debug1: Connecting to 10.14.169.25 [10.14.169.25] port 22.
debug1: Connection established.
debug1: identity file /home/core/.ssh/id_rsa type -1
debug1: identity file /home/core/.ssh/id_rsa-cert type -1
debug1: identity file /home/core/.ssh/id_ecdsa type -1
debug1: identity file /home/core/.ssh/id_ecdsa-cert type -1
debug1: identity file /home/core/.ssh/id_ecdsa_sk type -1
debug1: identity file /home/core/.ssh/id_ecdsa_sk-cert type -1
debug1: identity file /home/core/.ssh/id_ed25519 type -1
debug1: identity file /home/core/.ssh/id_ed25519-cert type -1
debug1: identity file /home/core/.ssh/id_ed25519_sk type -1
debug1: identity file /home/core/.ssh/id_ed25519_sk-cert type -1
debug1: identity file /home/core/.ssh/id_xmss type -1
debug1: identity file /home/core/.ssh/id_xmss-cert type -1
debug1: identity file /home/core/.ssh/id_dsa type -1
debug1: identity file /home/core/.ssh/id_dsa-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.6+Fips1
debug1: Remote protocol version 2.0, remote software version OpenSSH_8.9p1 Ubuntu-3ubuntu0.6+Fips1
debug1: compat_banner: match: OpenSSH_8.9p1 Ubuntu-3ubuntu0.6+Fips1 pat OpenSSH* compat 0x04000000
debug2: fd 3 setting O_NONBLOCK
debug1: Authenticating to 10.14.169.25:22 as 'onprem_shell'
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug2: local client KEXINIT proposal
debug2: KEX algorithms: ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,ext-info-c,kex-strict-c-v00 at openssh.com
debug2: host key algorithms: ssh-rsa,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521
debug2: ciphers ctos: aes128-cbc,aes256-cbc,aes128-ctr,aes256-ctr,aes128-gcm at openssh.com,aes256-gcm at openssh.com
debug2: ciphers stoc: aes128-cbc,aes256-cbc,aes128-ctr,aes256-ctr,aes128-gcm at openssh.com,aes256-gcm at openssh.com
debug2: MACs ctos: hmac-sha1
debug2: MACs stoc: hmac-sha1
debug2: compression ctos: none,zlib at openssh.com,zlib
debug2: compression stoc: none,zlib at openssh.com,zlib
debug2: languages ctos: 
debug2: languages stoc: 
debug2: first_kex_follows 0 
debug2: reserved 0 
debug2: peer server KEXINIT proposal
debug2: KEX algorithms: ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,kex-strict-s-v00 at openssh.com
debug2: host key algorithms: ssh-rsa,ecdsa-sha2-nistp256
debug2: ciphers ctos: aes128-cbc,aes256-cbc,aes128-ctr,aes256-ctr,aes128-gcm at openssh.com,aes256-gcm at openssh.com
debug2: ciphers stoc: aes128-cbc,aes256-cbc,aes128-ctr,aes256-ctr,aes128-gcm at openssh.com,aes256-gcm at openssh.com
debug2: MACs ctos: hmac-sha1
debug2: MACs stoc: hmac-sha1
debug2: compression ctos: none,zlib at openssh.com
debug2: compression stoc: none,zlib at openssh.com
debug2: languages ctos: 
debug2: languages stoc: 
debug2: first_kex_follows 0 
debug2: reserved 0 
debug1: kex: algorithm: ecdh-sha2-nistp256
debug1: kex: host key algorithm: ssh-rsa
debug1: kex: server->client cipher: aes128-cbc MAC: hmac-sha1 compression: none
debug1: kex: client->server cipher: aes128-cbc MAC: hmac-sha1 compression: none
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
Connection closed by 10.14.169.25 port 22

Thanks

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to openssh in Ubuntu.
https://bugs.launchpad.net/bugs/2059367

Title:
  SSH-RSA not supported for Self-SSH in Ubuntu 22.04 FIPS

Status in openssh package in Ubuntu:
  New

Bug description:
  On a FIPS Enabled Ubuntu 22.04 kernel, we are seeing an issue with self-ssh.
  We created a key with the following steps:
  touch /home/core/.ssh/known_hosts
    ssh-keygen -q -t rsa -f /home/core/.ssh/id_rsa -N '' > /dev/null
    cp /home/core/.ssh/id_rsa.pub /home/core/.ssh/authorized_keys
    chmod 0600 /home/core/.ssh/id_rsa
    chmod 0600 /home/core/.ssh/authorized_keys

  When we try to do a self ssh with the key, the following happens:
  ssh -i .ssh/id_rsa onprem_shell at 10.14.169.25
  Connection closed by 10.14.169.25 port 22

  FIPS status:
  cat /proc/sys/crypto/fips_enabled
  1

  PFB, the ssh dump:

  ssh -v user at 10.14.169.25
  OpenSSH_8.9p1 Ubuntu-3ubuntu0.6+Fips1, OpenSSL 3.0.2 15 Mar 2022
  debug1: Reading configuration data /etc/ssh/ssh_config
  debug1: /etc/ssh/ssh_config line 19: include /etc/ssh/ssh_config.d/*.conf matched no files
  debug1: /etc/ssh/ssh_config line 21: Applying options for *
  debug1: FIPS mode initialized
  debug1: Connecting to 10.14.169.25 [10.14.169.25] port 22.
  debug1: Connection established.
  debug1: identity file /root/.ssh/id_rsa type -1
  debug1: identity file /root/.ssh/id_rsa-cert type -1
  debug1: identity file /root/.ssh/id_ecdsa type -1
  debug1: identity file /root/.ssh/id_ecdsa-cert type -1
  debug1: identity file /root/.ssh/id_ecdsa_sk type -1
  debug1: identity file /root/.ssh/id_ecdsa_sk-cert type -1
  debug1: identity file /root/.ssh/id_ed25519 type -1
  debug1: identity file /root/.ssh/id_ed25519-cert type -1
  debug1: identity file /root/.ssh/id_ed25519_sk type -1
  debug1: identity file /root/.ssh/id_ed25519_sk-cert type -1
  debug1: identity file /root/.ssh/id_xmss type -1
  debug1: identity file /root/.ssh/id_xmss-cert type -1
  debug1: identity file /root/.ssh/id_dsa type -1
  debug1: identity file /root/.ssh/id_dsa-cert type -1
  debug1: Local version string SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.6+Fips1
  debug1: Remote protocol version 2.0, remote software version OpenSSH_8.9p1 Ubuntu-3ubuntu0.6+Fips1
  debug1: compat_banner: match: OpenSSH_8.9p1 Ubuntu-3ubuntu0.6+Fips1 pat OpenSSH* compat 0x04000000
  debug1: Authenticating to 10.14.169.25:22 as 'user'
  debug1: SSH2_MSG_KEXINIT sent
  debug1: SSH2_MSG_KEXINIT received
  debug1: kex: algorithm: ecdh-sha2-nistp256
  debug1: kex: host key algorithm: ssh-rsa
  debug1: kex: server->client cipher: aes128-cbc MAC: hmac-sha1 compression: none
  debug1: kex: client->server cipher: aes128-cbc MAC: hmac-sha1 compression: none
  debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
  Connection closed by 10.14.169.25 port 22

  hostname -i
  10.14.169.25

  Please note that SSH onto other hosts (both FIPS and non-FIPS) works.
  The only workaround that we have found has been removing the ssh-rsa
  entry from “HostKeyAlgorithms” in “etc/ssh/sshd_config” and restarting
  the SSH service. This issue has neither been encountered in the Ubuntu
  18.04 FIPS nor Ubuntu 20.04 FIPS.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/2059367/+subscriptions