Skip to content

SSH doesn't work with DSA keys #375

Closed

Description

@chrmatt

I have the same problem as described in issue #343, which was closed due to a not-responding OP. The problem seems to be that SSH does not work anymore with DSA keys. This problem exists with git 2.5.1 and 2.5.2 (both 64 Bit) on Windows 8.1 and Windows 10 (both 64 Bit). Git 2.5.0 worked fine on both systems.

To reproduce the problem do the following:

  • ssh-keygen -t DSA
  • add ~/.ssh/id_dsa.pub to authorized_keys on remote system
  • ssh to remote system -> need to enter password

The same works fine if RSA is used instead of DSA.

Activity

  1. dscho commented on Sep 11, 2015

    @dscho
    Member

    Thanks for your report, and in particular for testing with several Git for Windows versions and documenting properly what works and what does not.

    Your Minimal, Complete and Verifiable Example was very clear and helped me reproduce the problem quickly. Thank you so much!

    When passing -v -v -v -v to ssh, this line looks like it indicates the culprit:

    debug1: Skipping ssh-dss key .ssh/test.id_dsa for not in PubkeyAcceptedKeyTypes
    

    which makes me believe that something in the OpenSSH configuration has changed that specifically excludes DSA public keys.

    The most notable difference between 2.5.0 and 2.5.2 is this:

    -openssh 6.9p1-1
    +openssh 7.1p1-1

    (found by comparing /etc/package-versions.txt in extracted portable Gits).

    Now, the release notes for OpenSSH 7.1 did not reveal anything, but the release notes for OpenSSH 7.0 contain this hint:

    • Support for ssh-dss, ssh-dss-cert-* host and user keys is disabled by default at run-time. These may be re-enabled using the instructions at http://www.openssh.com/legacy.html

    The linked page says:

    OpenSSH 7.0 and greater similarly disables the ssh-dss (DSA) public key algorithm. It too is weak and we recommend against its use.

    If you must use that key, you could pass the -o PubkeyAcceptedKeyTypes=ssh-dss option to ssh, and if you cannot replace the weak key by a stronger one, you can put the line PubkeyAcceptedKeyTypes ssh-dss into the section of your $HOME/.ssh/config that corresponds to the SSH host you want to connect to.

  2. self-assigned this
    on Sep 11, 2015
  3. Ostefanini commented on Nov 6, 2016

    @Ostefanini

    Thank you so much !

  4. added a commit that references this issue on Jun 21, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions