-
Bug
-
Resolution: Unresolved
-
Minor
-
None
-
rhel-9.1.0
-
None
-
Moderate
-
rhel-sst-security-crypto
-
ssg_security
-
None
-
False
-
-
None
-
None
-
None
-
None
-
If docs needed, set a value
-
-
Unspecified
-
None
Description of problem: libssh client stops connecting to openssh server accepting rsa-sha only if other sigalgs are enabled
Version-Release number of selected component: libssh-0.9.6-3.el9
How reproducible: reliably
Steps to Reproduce:
- do not run on non-disposable systems
set -uexo pipefail
dnf -y install crypto-policies-scripts curl openssh
[[ -e ~/.ssh/id_rsa ]] || ssh-keygen -t rsa -f /root/.ssh/id_rsa -N ""
cat ~/.ssh/id_rsa.pub >> ~/.ssh/authorized_keys
ssh-keyscan localhost | tee -a .ssh/known_hosts
echo "sign = RSA-SHA1" \
> /etc/crypto-policies/policies/modules/RSA-SHA1-ONLY.pmod
echo "sign = RSA-SHA2-256 RSA-SHA1" \
> /etc/crypto-policies/policies/modules/RSA-SHA1-PLUS.pmod
update-crypto-policies --set LEGACY:RSA-SHA1-ONLY
curl -k sftp://localhost # works
update-crypto-policies --set LEGACY:RSA-SHA1-PLUS --no-reload
curl -k sftp://localhost # breaks
update-crypto-policies --set LEGACY --no-reload
curl -k sftp://localhost # not gonna work too