Bug 2190476 - paramiko 2.4.3 cannot auth with RSA keypairs to RHEL 9 servers
Summary: paramiko 2.4.3 cannot auth with RSA keypairs to RHEL 9 servers
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora EPEL
Classification: Fedora
Component: python-paramiko
Version: epel8
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Othman Madjoudj
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2023-04-28 14:14 UTC by Ken Dreyer (Red Hat)
Modified: 2023-06-06 03:07 UTC (History)
8 users (show)

Fixed In Version: python-paramiko-2.12.0-1.el8
Clone Of:
Environment:
Last Closed: 2023-06-06 03:07:27 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)

Description Ken Dreyer (Red Hat) 2023-04-28 14:14:29 UTC
Description of problem:
python3-paramiko-2.4.3-2.el8 cannot authenticate with RSA keypairs to RHEL 9 servers.

Version-Release number of selected component (if applicable):
python3-paramiko-2.4.3-2.el8 

How reproducible:
always

Steps to Reproduce:
1. Set up an el8 SSH client and el9 SSH server with an RSA SSH key pair (id_rsa, id_rsa.pub).
2. On the el8 system, yum install python3-paramiko 2.4.3 from EPEL 8.
3. Run the test.py script that connects with pubkey auth and copies a file:

  import paramiko
  import logging
  paramiko.util.get_logger("paramiko.transport").setLevel(logging.DEBUG)
  paramiko.util.get_logger("paramiko").setLevel(logging.DEBUG)

  ssh = paramiko.SSHClient()
  ssh.load_system_host_keys()
  ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy())
  ssh.connect('192.168.122.10', username='cloud-user')
  sftp = ssh.open_sftp()
  sftp.put('/etc/issue', 'issue.txt')
  sftp.close()
  ssh.close()

Actual results:

ssh.connect() fails with paramiko.ssh_exception.AuthenticationException: Authentication failed.

The RHEL 9 /var/log/secure shows:

Apr 28 09:51:11 localhost sshd[18154]: userauth_pubkey: key type ssh-rsa not in PubkeyAcceptedAlgorithms [preauth]
Apr 28 09:51:11 localhost sshd[18154]: Connection closed by authenticating user cloud-user 192.168.122.148 port 54648 [preauth]

Expected results:

The test.py script succeeds, and the el8 client can copy a file to el9.

RHEL 9 /var/log/secure shows:

Apr 28 09:51:25 localhost sshd[18156]: Accepted publickey for cloud-user from 192.168.122.148 port 55688 ssh2: RSA SHA256:ChUHxaJ82BRLvPdm7q44Sj/njKZ6k0d8WoOotPBPrj0
Apr 28 09:51:25 localhost sshd[18156]: pam_unix(sshd:session): session opened for user cloud-user(uid=1000) by (uid=0)
Apr 28 09:51:25 localhost sshd[18156]: pam_unix(sshd:session): session closed for user cloud-user

Additional info:
Updating el8 to the version in epel9 (2.12.0) works perfectly, so I propose that we update epel8 to that version.

Comment 1 Ken Dreyer (Red Hat) 2023-04-28 14:16:42 UTC
https://src.fedoraproject.org/rpms/python-paramiko/pull-request/2 merges the epel9 branch into epel8, resolving this bug.

Comment 2 Ken Dreyer (Red Hat) 2023-04-28 14:17:45 UTC
I've built this newer version for epel8 at https://copr.fedorainfracloud.org/coprs/ktdreyer/paramiko/

Comment 3 Ken Dreyer (Red Hat) 2023-05-19 15:35:49 UTC
FYI: Paramiko 2.4 can do RSA pubkey auth to RHEL 6 hosts fine, but with 2.9+ you will need to set disabled_algorithms or connect() will raise AuthenticationException. Here's the code I'm using:

try:
    ssh.connect('192.168.122.10', username='cloud-user')
except paramiko.ssh_exception.AuthenticationException:
    # This host could be RHEL 6, so disable rsa-sha2:
    ssh.connect('192.168.122.10', username='cloud-user',
                disabled_algorithms={'pubkeys': ['rsa-sha2-512',
                                                 'rsa-sha2-256']})

Comment 4 Fedora Update System 2023-05-28 23:30:18 UTC
FEDORA-EPEL-2023-294cf22ce7 has been submitted as an update to Fedora EPEL 8. https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2023-294cf22ce7

Comment 5 Fedora Update System 2023-05-29 01:39:21 UTC
FEDORA-EPEL-2023-294cf22ce7 has been pushed to the Fedora EPEL 8 testing repository.

You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2023-294cf22ce7

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 6 Fedora Update System 2023-06-06 03:07:27 UTC
FEDORA-EPEL-2023-294cf22ce7 has been pushed to the Fedora EPEL 8 stable repository.
If problem still persists, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.