ssh: support for new key algorithms rsa-sha2-256/rsa-sha2-512

[wenerme]

# ok with identity file
SSH_AUTH_SOCK= ssh -i ./credentials/admin_rsa admin@192.168.1.61 uname
# ok with ssh-agent
ssh admin@192.168.1.61 uname

spec:
  hosts:
  - ssh:
      address: 192.168.1.61
      user: admin
      port: 22
      keyPath: ./credentials/admin_rsa
    role: controller+worker

# not ok
k0sctl reset -f
# not ok
SSH_AUTH_SOCK= k0sctl reset -f

output

k0sctl v0.12.6 Copyright 2021, k0sctl authors.
By continuing to use k0sctl you agree to these terms:
https://k0sproject.io/licenses/eula
INFO ==> Running phase: Connect to hosts 
ERRO [ssh] 192.168.1.61:22: failed to connect: ssh: handshake failed: ssh: unable to authenticate, attempted methods [none publickey], no supported methods remain 
FATA failed on 1 hosts:
 - [ssh] 192.168.1.61:22: ssh: handshake failed: ssh: unable to authenticate, attempted methods [none publickey], no supported methods remain 

version

version: v0.12.6
commit: d5f7d66

[kke]

How about leaving out keyPath and just using the agent?

[wenerme]

I will try when I back home.

Why address must be ip address instead allowed host in ~/.ssh/config, can not access this host without multi jump host.

[wenerme]

@kke without keyPath

ERRO can't parse keyfile ~/.ssh/id_rsa: ssh: this private key is passphrase protected 

but the key is already added

ssh-add -l | grep credentials/admin_rsa

[wenerme]

removed ~/.ssh/id_rsa still get the same error, but ssh works.

[kke]

Hmm, I wonder if it's actually trying to use the SSH_AUTH_SOCK, it should try it right after that error.

	_, err := os.Stat(c.KeyPath)
	if err != nil && !c.keypathDefault { 
		return err
	}
	if err == nil {
		var key []byte
		key, err = os.ReadFile(c.KeyPath)
		if err != nil {
			return err
		}
		signer, err := ssh.ParsePrivateKey(key)
		if err != nil {
			log.Errorf("can't parse keyfile %s: %s", c.KeyPath, err.Error())  // <-- the error comes from here
		} else {
			pubkeySigners = append(pubkeySigners, signer)
		}
	}

	sshAgentSock := os.Getenv("SSH_AUTH_SOCK") // <-- it should continue from here even with the error message
	if sshAgentSock != "" {
		sshAgent, err := net.Dial("unix", sshAgentSock)
		if err != nil {
			log.Errorf("can't connect to SSH agent auth socket %s: %s", sshAgentSock, err)
		} else {
			signers, err := agent.NewClient(sshAgent).Signers()
			if err == nil {
				pubkeySigners = append(pubkeySigners, signers...)
			}
		}
	}

Jump-hosts are possible via the "bastion" setting:

spec:
  hosts:
    - role: controller
      ssh:
        address: 10.0.0.2
        user: ubuntu
        keyPath: ~/.ssh/id_rsa
        bastion:
          address: 10.0.0.1
          user: root
          keyPath: ~/.ssh/id_rsa2

Using named hosts from ~/.ssh/config is doable, but there may be some problems when k0sctl tries to use the address for figuring things out in the discovery phase.

[wenerme]

@kke To access the host need tow jump host.

Maybe caused by golang/go#49952

ssh-keygen -l -f key

2048 SHA256:XXX  (RSA)

dose this mean the key is rsa-sha2-256

[kke]

I'll update the ssh library dependency, let's see what that does.

[wenerme]

One more reference bfritz/homelab-bootstrap@11fad69

Using alpine 3.15

[wenerme]

This is the problem, after add

PubkeyAcceptedAlgorithms +ssh-rsa

to sshd_config, works now.

[wenerme]

@kke still not fixed, x/crypto/ssh do not support rsa-sha2-256/rsa-sha2-512 according to golang/go#49952

[kke]

This will have to wait then, good thing there's a workaround.

[wenerme]

how about switch to this for now ?

replace golang.org/x/crypto => github.com/rmohr/crypto v0.0.0-20211203105847-e4ed9664ac54

enable ssh-ras is not good