Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

x/crypto/ssh: server does not accept rsa-sha2-256 and rsa-sha2-512 signatures #46569

Closed
Tracked by #49952
samiponkanen opened this issue Jun 4, 2021 · 1 comment
Closed
Tracked by #49952
Labels
FrozenDueToAge NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one.
Milestone

Comments

@samiponkanen
Copy link

What version of Go are you using (go version)?

$ go version
go version go1.16.4 linux/amd64

Does this issue reproduce with the latest release?

Yes

What operating system and processor architecture are you using (go env)?

go env Output
$ go env
GO111MODULE=""
GOARCH="amd64"
GOBIN=""
GOCACHE="/home/samiponkanen/.cache/go-build"
GOENV="/home/samiponkanen/.config/go/env"
GOEXE=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="linux"
GOINSECURE=""
GOMODCACHE="/home/samiponkanen/go/pkg/mod"
GONOPROXY=""
GONOSUMDB=""
GOOS="linux"
GOPATH="/home/samiponkanen/go"
GOPRIVATE=""
GOPROXY="https://proxy.golang.org,direct"
GOROOT="/usr/local/lib/go"
GOSUMDB="sum.golang.org"
GOTMPDIR=""
GOTOOLDIR="/usr/local/lib/go/pkg/tool/linux_amd64"
GOVCS=""
GOVERSION="go1.16.4"
GCCGO="gccgo"
AR="ar"
CC="gcc"
CXX="g++"
CGO_ENABLED="1"
GOMOD="/home/samiponkanen/src/github.com/samiponkanen/crypto/go.mod"
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build2597822555=/tmp/go-build -gno-record-gcc-switches"

What did you do?

Use Tectia SSH client with RSA publickey authentication to connect to ssh server using the golang.org/x/crypto/ssh package. This results into the following errors in ssh.ServerConfig.AuthLogCallback():

2021/06/04 13:11:32 [ERROR] client-auth.go:144 conn ec66cf06-3dc4-49f7-67e0-e1cb9e6fbeb1: auth user 'root' local '172.23.0.21:2222' remote '192.168.200.101:45110' client-version 'SSH-2.0-6.4.19.367 SSH Secure Shell' server-version 'SSH-2.0-Go' session-id db28a8ab840ffc68684be3974c7a001a4f547806 error: ssh: algorithm "rsa-sha2-256" not accepted
2021/06/04 13:11:32 [ERROR] client-auth.go:144 conn ec66cf06-3dc4-49f7-67e0-e1cb9e6fbeb1: auth user 'root' local '172.23.0.21:2222' remote '192.168.200.101:45110' client-version 'SSH-2.0-6.4.19.367 SSH Secure Shell' server-version 'SSH-2.0-Go' session-id db28a8ab840ffc68684be3974c7a001a4f547806 error: ssh: algorithm "rsa-sha2-512" not accepted

Modifying unit test TestClientAuthPublicKey() in ssh/client_auth_test.go to sign using "rsa-sha2-256" or "rsa-sha2-512" algorithm causes the unit test to fail:

$ go test -v -run ^TestClientAuthPublicKey
=== RUN   TestClientAuthPublicKey
    client_auth_test.go:117: unable to dial remote side: ssh: handshake failed: ssh: unable to authenticate, attempted methods [none publickey], no supported methods remain
--- FAIL: TestClientAuthPublicKey (0.01s)
FAIL
exit status 1
FAIL    golang.org/x/crypto/ssh 0.043s

Adding SigAlgoRSASHA2256 and SigAlgoRSASHA2512 to isAcceptableAlgo() fixes the problem.

What did you expect to see?

Expected ssh server to accept rsa-sha2-256 and rsa-sha2-512 signatures.

What did you see instead?

Ssh server rejects rsa-sha2-256 and rsa-sha2-512 in user auth message's public key algorithm name and signature format fields.

@seankhliao seankhliao changed the title ssh: server does not accept rsa-sha2-256 and rsa-sha2-512 signatures x/crypto/ssh: server does not accept rsa-sha2-256 and rsa-sha2-512 signatures Jun 4, 2021
@gopherbot gopherbot added this to the Unreleased milestone Jun 4, 2021
@dr2chase dr2chase added the NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one. label Jun 4, 2021
@rolandshoemaker
Copy link
Member

This is fixed as of https://golang.org/cl/220037, the server does now accept these algorithms.

@golang golang locked and limited conversation to collaborators Jun 23, 2023
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
FrozenDueToAge NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one.
Projects
None yet
Development

Successfully merging a pull request may close this issue.

5 participants