On Sat, 21 Nov 2020, Francis.Montagnac@xxxxxxxx wrote:
Hi
On Sat, 21 Nov 2020 14:14:23 -0500 Max Pyziur wrote:
Even though I had done the F33 upgrade sometime ago, I am only now seeing
that it appears to have affected my rsync backups. When my CentOS server
issues the rsync backup the following error appears:
no hostkey alg
rsync: connection unexpectedly closed (0 bytes received so far) [receiver]
rsync error: unexplained error (code 255) at io.c(600) [receiver=3.0.6]
Seen that.
You have to change the configuration of sshd on your F33 machine.
I've chosen to not modify the crypto policies, but to enable ssh-rsa with a
snippet under /etc/ssh/sshd_config.d/
-------------------- /etc/ssh/sshd_config.d/20-NAME.conf ---------
# To load *before* 50-redhat.conf
# From /etc/crypto-policies/back-ends/opensshserver.config
# then add ,ssh-rsa No +ssh-rsa allowed (seems)
HostKeyAlgorithms ecdsa-sha2-nistp256,ecdsa-sha2-nistp256-cert-v01@xxxxxxxxxxx,sk-ecdsa-sha2-nistp256@xxxxxxxxxxx,sk-ecdsa-sha2-nistp256-cert-v01@xxxxxxxxxxx,ecdsa-sha2-nistp384,ecdsa-sha2-nistp384-cert-v01@xxxxxxxxxxx,ecdsa-sha2-nistp521,ecdsa-sha2-nistp521-cert-v01@xxxxxxxxxxx,ssh-ed25519,ssh-ed25519-cert-v01@xxxxxxxxxxx,sk-ssh-ed25519@xxxxxxxxxxx,sk-ssh-ed25519-cert-v01@xxxxxxxxxxx,rsa-sha2-256,rsa-sha2-256-cert-v01@xxxxxxxxxxx,rsa-sha2-512,rsa-sha2-512-cert-v01@xxxxxxxxxxx,ssh-rsa
# Weird: this +ssh-rsa works here.
# The setting (without +) in
# /etc/crypto-policies/back-ends/opensshserver.config
# do not lose this +ssh-rsa
PubkeyAcceptedKeyTypes +ssh-rsa
----------------------------------------------------------------------
The 20- prefix is needed to be alphabetically before 50-redhat.conf
that loads/include /etc/crypto-policies/back-ends/opensshserver.config
Thank you for your reply. I'll review this.
In the meantime, for the sake of expediency, I've issued the following
command on the client F33 machines as root:
update-crypto-policies --set LEGACY
Once executed, it says that the machine needs to be rebooted for the
policies to properly go into effect.
This has caused the rsync backup that I have in place to function.
But in the current world, tougher rather than looser encryption is better.
Thank you again,
Max
_______________________________________________
users mailing list -- users@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to users-leave@xxxxxxxxxxxxxxxxxxxxxxx
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/users@xxxxxxxxxxxxxxxxxxxxxxx
