On 04.12.24 19:47, Brian Candler wrote:
debug1: Offering public key: /Users/brian/.ssh/id_rsa RSA [...] debug1: send_pubkey_test: no mutual signature algorithm <<<< *THIS*I wonder if there could there be some way to highlight the "no mutual signature algorithm" message more prominently in normal operation?
Wouldn't the extra output, even in cases where a different keypair succeeds later on, threaten to hose applications that expect the connection to be transparent (or fail completely)? As in, rsync, git, etc.?
In general, the client may try a number of keypairs and every try has a number of possible reasons to fail, from cryptalgorithm-related ones (including "cipher (here: RSA) rejected" and "hash (here: SHA2 variant(s)) rejected") to "unknown keypair" to less-frequent ones (like "pubkey has a ForceCommand option and I can't execute that" etc.). I don't think that we should try to triage these cases into "interesting ones" that do emit a(n interim) warning, and the rest that doesn't.
*If* the login fails *altogether*, however, doing a "post mortem" and adding a line to the effect of "oh, by the way, *one* of the keypairs failed only because of rare condition XY" could still be helpful.
Kind regards, -- Jochen Bern Systemingenieur Binect GmbH
Attachment:
smime.p7s
Description: S/MIME Cryptographic Signature
_______________________________________________ openssh-unix-dev mailing list openssh-unix-dev@xxxxxxxxxxx https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev
