topic Re: issues with ssh access from macos/ linux in General Topics

issues with ssh access from macos/ linux

nevolex — Fri, 05 May 2023 23:44:08 GMT

Hi folks I am having issues with access via ssh from macos/ linux pcs

pc ~ % ssh admin@10.10.10.1

Unable to negotiate with 10.10.10.1 port 22: no matching host key type found. Their offer: ssh-rsa

I can access it using this modified command:

ssh -oHostKeyAlgorithms=+ssh-rsa admin@10.10.10.1

I have added these options to ssh profile, restarted ssh server/ rebooted as well for testing, but still getting same results

Unable to negotiate with 10.10.10.1 port 22: no matching host key type found. Their offer: ssh-rs

Does anyone know what needs to be configured on the palo alto to resolve ssh compatibility issues?

thank you

Re: issues with ssh access from macos/ linux

JayGolf — Mon, 08 May 2023 01:13:00 GMT

Hi @nevolex ,

Is this a VM-Series FW hosted in the public cloud?

Re: issues with ssh access from macos/ linux

TorokAdam — Thu, 18 May 2023 09:52:32 GMT

Did you select the SSH Service Profile you just made on Device\Setup\Management\SSH Management Profile Settings? And then restart the ssh server. (it will tell you to do so after commit)

I've just made the same setting for the same reason and missed this step.

Re: issues with ssh access from macos/ linux

akuzhuppilly — Fri, 19 May 2023 01:45:56 GMT

Hello,

For a successful ssh connection at least one mutually-supported choice for each parameter, OpenSSH considers SSH-RSA as a weak algorithm and it has been deprecated since OpenSSH 8.8, it is still supported but disabled by default.
Can you try to connect to the FW by adding the following to your command line: -oHostKeyAlgorithms=+ssh-rsa

Eg;
ssh -oHostKeyAlgorithms=+ssh-rsa username@x.x.x.x

Re: issues with ssh access from macos/ linux

pgfarvour — Wed, 19 Jul 2023 21:32:33 GMT

This is a problem for us as well. Is there a way to have the PA appliance generate keys using SHA2+? I've tried setting the server profile to use ECDSA 256+ and the connection still fails,.. likely because the SSH server is still trying to present the RSA version... I would have expected this to use ECDSA only, and not try and present ssh-rsa keys to the client... eg.

debug2: reserved 0
debug1: kex: algorithm: ecdh-sha2-nistp384
debug1: kex: host key algorithm: (no match)
Unable to negotiate with <redacted> port 22: no matching host key type found. Their offer: ssh-rsa

ssh {
profiles {
mgmt-profiles {
server-profiles {
default_high_security {
ciphers [ aes256-cbc aes256-gcm aes256-ctr];
kex [ ecdh-sha2-nistp384 ecdh-sha2-nistp521];
mac [ hmac-sha2-256 hmac-sha2-512];
session-rekey {
data default;
interval default;
packets default;
}
default-hostkey {
key-type {
ECDSA 384;
}
}
}
}
}
}
regenerate-hostkeys {
mgmt {
key-type {
ECDSA {
key-length 256;
}
}
}
}
mgmt {
server-profile default_high_security;
}
}
[edit deviceconfig system ssh]

Re: issues with ssh access from macos/ linux

DGutierrez — Fri, 22 Sep 2023 11:01:08 GMT

This worked. Thank you!

Re: issues with ssh access from macos/ linux

mghazzi — Wed, 03 Jan 2024 23:02:17 GMT

This changed in PanOS 10.2 and higher, you can verify using "nmap --script ssh2-enum-algos -sV -p 22 192.168.1.1" you will find that:

PanOS 10.1 had

| server_host_key_algorithms: (3)

| ssh-rsa

| rsa-sha2-512

| rsa-sha2-256

But PanOS 10.2 only has

| server_host_key_algorithms: (1)

| ssh-rsa

you need to tell your ssh client to use the larger key size algorithm

The temporary fix is to use:

ssh -oHostKeyAlgorithms=+ssh-rsa admin@192.168.1.1

While the permanent fix is to:

EITHER

1) Create a Shell alias like this that modifies the command ssh and adds support for ssh-rsa host key algorithm evreytime you run ssh

alias ssh='ssh -oHostKeyAlgorithms=+ssh-rsa'

2) modify your SSH Config File (requires sudo) to add support for ssh-rsa host key algorithm

sudo nano ~/.ssh/config

and then add the line

HostKeyAlgorithms +ssh-rsa

Re: issues with ssh access from macos/ linux

mghazzi — Wed, 03 Jan 2024 23:11:51 GMT

adjusting the HOSTKEY to ALL doesn't help, because ALL=ECDSA or RSA, but the only RSA Hostkey Algorithms in PanOS 10.2 and higher are RSA 2048, 3072, or 4096 (known as ssh-rsa) The only way to connect is to tell the SSH client to step up to rsa 2048 or more, or go with ECDSA.

Re: issues with ssh access from macos/ linux

YounosN1 — Sat, 16 Nov 2024 04:47:17 GMT

Make sure to restart ssh service, this will not work without it:

admin@whatever> set ssh service-restart mgmt

Here's the rest of my config:

[edit deviceconfig system ssh] admin@whatever# show ssh { profiles { mgmt-profiles { server-profiles { management { ciphers aes256-gcm; kex ecdh-sha2-nistp256; mac hmac-sha2-256; default-hostkey { key-type { all; } } } } } } mgmt { server-profile management; } }

Tested this in version 11.1.4-h