forked from linux/documentation
85 lines
2.7 KiB
Markdown
85 lines
2.7 KiB
Markdown
# SSH To Legacy Linux Systems
|
|
|
|
On RHEL8 and newer systems Redhat started to remove the support for certain SSL algorithms that are considered unsafe to use.
|
|
Therefore connections to (very) old Linux systems do not work out of the box without specifying certain exceptions/parameters
|
|
|
|
The most common options that might be needed are the following:
|
|
```bash
|
|
ssh -v \
|
|
-o KexAlgorithms=diffie-hellman-group1-sha1 \
|
|
-o Ciphers=3des-cbc \
|
|
-o HostkeyAlgorithms=ssh-rsa \
|
|
<yoursystem>
|
|
```
|
|
|
|
The algorithms (i.e. the part after the `=` need to be adapted towards the system you try to connect to)
|
|
|
|
|
|
## Allow Legacy Crypto Policies
|
|
|
|
On RHEL9 or newer the system administrator even might need to explicitly allow legacy crypto policies.
|
|
|
|
|
|
A usual error message pointing to this is:
|
|
```bash
|
|
debug1: Host 'x02da-gfctrl-2' is known and matches the RSA host key.
|
|
debug1: Found key in /home/ebner/.ssh/known_hosts:1
|
|
debug1: openssl error C0BDF464547F0000:error:03000098:digital envelope routines:do_sigver_init:invalid digest:crypto/evp/m_sigver.c:340:
|
|
|
|
ssh_dispatch_run_fatal: Connection to 129.129.99.82 port 22: error in libcrypto
|
|
```
|
|
|
|
|
|
The easiest way is to allow SHA1 generally by setting the systems crypto policy accordingly. With Hiera/Pupppet this is
|
|
|
|
```
|
|
base::crypto_policy: 'DEFAULT:SHA1'
|
|
```
|
|
(see [Cryptographic Policy](../admin-guide/configuration/basic/crypto_policy))
|
|
|
|
|
|
Alternatively you might allow these outdated cryptographic algorithms not system wide but individually for the required connections:
|
|
|
|
|
|
Create a file openssl_legacy.cnf with the following content:
|
|
```
|
|
.include /etc/ssl/openssl.cnf
|
|
[openssl_init]
|
|
alg_section = evp_properties
|
|
[evp_properties]
|
|
rh-allow-sha1-signatures = yes
|
|
|
|
```
|
|
|
|
SSH to the legacy system with the following command:
|
|
```bash
|
|
OPENSSL_CONF=openssl_legacy.cnf ssh -oHostKeyAlgorithms=+ssh-rsa -oPubkeyAcceptedAlgorithms=+ssh-rsa -o KexAlgorithms=diffie-hellman-group1-sha1 <your_legacy_system>
|
|
```
|
|
|
|
To avoid creating a file and simplifying the process we recommend to create a helper script script like this `ssh_legacy.sh` to avoid leaving legacy settings/files on the system:
|
|
|
|
```bash
|
|
#!/bin/bash
|
|
|
|
tmpfile=$(mktemp)
|
|
echo ${tmpfile}
|
|
cat <<EOF > "$tmpfile"
|
|
.include /etc/ssl/openssl.cnf
|
|
[openssl_init]
|
|
alg_section = evp_properties
|
|
[evp_properties]
|
|
rh-allow-sha1-signatures = yes
|
|
EOF
|
|
|
|
# Set up a trap to delete the temp file on exit (success, error, or interrupt)tr
|
|
trap 'rm -f "$tmpfile"' EXIT
|
|
|
|
OPENSSL_CONF="$tmpfile" ssh -oHostKeyAlgorithms=+ssh-rsa -oPubkeyAcceptedAlgorithms=+ssh-rsa -o KexAlgorithms=diffie-hellman-group1-sha1 $@
|
|
```
|
|
|
|
```{note}
|
|
Only use the above workaround if you really have to connect to legacy systems! Legacy algorithms are considered insecure and should be avoided whenever possible.
|
|
```
|
|
|
|
|