mirrors/vault
1
0
Fork 0
mirror of https://github.com/hashicorp/vault.git synced 2025-11-13 14:51:34 +01:00
Code Issues Projects Releases Wiki Activity

Address algorithm not supported (#12852)

Browse Source 
error seen on host /var/log/auth.log:
  userauth_pubkey: certificate signature algorithm ssh-rsa: signature algorithm not supported [preauth]
This commit is contained in:
castironclay 2021-11-04 18:07:46 -04:00 committed by GitHub
parent cb590a3b27
commit d9b12933ec
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 11 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
website/content/docs/secrets/ssh/signed-ssh-certificates.mdx
View File

@ -475,7 +475,6 @@ forwarding. See [no prompt after login](#no-prompt-after-login) for examples.
``` ```
### Known Issues ### Known Issues
- On SELinux-enforcing systems, you may need to adjust related types so that the - On SELinux-enforcing systems, you may need to adjust related types so that the
SSH daemon is able to read it. For example, adjust the signed host certificate SSH daemon is able to read it. For example, adjust the signed host certificate
to be an `sshd_key_t` type. to be an `sshd_key_t` type.
@ -490,6 +489,17 @@ forwarding. See [no prompt after login](#no-prompt-after-login) for examples.
[OpenSSH bug 2617](https://bugzilla.mindrot.org/show_bug.cgi?id=2617) for [OpenSSH bug 2617](https://bugzilla.mindrot.org/show_bug.cgi?id=2617) for
details. details.
- On some versions of SSH, you may get the following error on target host:
```text
userauth_pubkey: certificate signature algorithm ssh-rsa: signature algorithm not supported [preauth]
```
Fix is to add below line to /etc/ssh/sshd_config
```text
CASignatureAlgorithms ^ssh-rsa
```
The ssh-rsa algorithm is no longer supported in [OpenSSH 8.2](https://www.openssh.com/txt/release-8.2)
## API ## API
The SSH secrets engine has a full HTTP API. Please see the The SSH secrets engine has a full HTTP API. Please see the