Red Hat Bugzilla – Bug 1456853
ssh -Q and -G list host key types that are not allowed in FIPS mode
Last modified: 2018-04-10 14:20:29 EDT
Description of problem: When the system is put in fips mode, `ssh -Q key` and `ssh -G example.com | grep key` list algorithms that use the DSS authentication method. Because DSS in SSH can use only 1024 bit keys, that are considered too weak now, and they are not supported, but are still listed by the above commands Version-Release number of selected component (if applicable): openssh-7.4p1-11.el7.x86_64 How reproducible: always Steps to Reproduce: 1. ssh -Q key | grep dss 2. ssh -G example.com | grep dss 3. Actual results: ssh-dss ssh-dss-cert-v01@openssh.com hostkeyalgorithms (...),ssh-rsa,ssh-dss hostbasedkeytypes (...),ssh-rsa,ssh-dss pubkeyacceptedkeytypes (...),ssh-dss Expected results: no dss types listed Additional info:
We should not use ed25519 keys either in FIPS, which is also listed there. After applying the patch, the output in FIPS looks this: # ssh -Q key ssh-rsa ecdsa-sha2-nistp256 ecdsa-sha2-nistp384 ecdsa-sha2-nistp521 ssh-rsa-cert-v01@openssh.com ecdsa-sha2-nistp256-cert-v01@openssh.com ecdsa-sha2-nistp384-cert-v01@openssh.com ecdsa-sha2-nistp521-cert-v01@openssh.com # ssh -G example.com | grep dss (empty) I have got the patch ready to fix it in 7.4 or later.
no ... we can not remove them from the output of the -Q option, because the keys are technically enabled, but just not used by default. The -G should certainly not list them.
*** Bug 1459249 has been marked as a duplicate of this bug. ***
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2018:0980