Your message dated Tue, 21 Jul 2026 12:53:45 +0200
with message-id <[email protected]>
and subject line libssh2-1: cannot authenticate against openssh-server from
bookworm (ssh-rsa not enabled server side)
has caused the Debian Bug report #1009760,
regarding libssh2-1: cannot authenticate against openssh-server from bookworm
(ssh-rsa not enabled server side)
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1009760: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1009760
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: libssh2-1
Version: 1.10.0-3
Severity: normal
Dear Maintainer,
With gitolite or with php-ssh2 ssh2_auth_pubkey_file I cannot authenticate to
my bookworm
openssh-server 1:9.0p1-1 (to install redmine debian package from sid bookworm
libc6
was required. Bullseye openssh-server 1:8.4p1-5 with bookworm libc6 breaks due
to sshd
sandbox-seccomp-filter.c missing __NR_pselect6_time64 def).
php-ssh2 libssh2-1 1.10.0-3 fails with:
PHP Warning: ssh2_auth_pubkey_file(): Authentication failed for git using
public key: Username/PublicKey combination invalid in /opt/gitolite/ssh.php on
line 5
cannot connect
and the server logs:
Apr 16 14:53:59 uruk sshd[7116]: userauth_pubkey: signature algorithm ssh-rsa
not in PubkeyAcceptedAlgorithms [preauth]
Apr 16 14:53:59 uruk sshd[7116]: Received disconnect from ::1 port 53042:11:
PECL/ssh2 (http://pecl.php.net/packages/ssh2) [preauth]
Apr 16 14:53:59 uruk sshd[7116]: Disconnected from authenticating user git ::1
port 53042 [preauth]
The php script is:
<?php
if (!($con = ssh2_connect("localhost", 22))) {
echo "failed to establish ssh connection\n";
} else {
if (!ssh2_auth_pubkey_file($con, "git",
"/opt/gitolite/.ssh/redmine_gitolite_admin_id_rsa_mirroring.pub",
"/opt/gitolite/.ssh/redmine_gitolite_admin_id_rsa_mirroring")) {
echo "cannot connect\n";
} else {
echo "logged in\n";
if (!($stream = ssh2_exec($con, "info"))) {
echo "unable to execute command\n";
} else {
stream_set_blocking($stream, true);
$data = "";
while ($buf = fread($stream, 4096)) {
$data .= $buf;
}
fclose($stream);
echo $data. "\n";
}
}
}
and the server git user home has in .ssh/authorized_keys
command="/usr/share/gitolite3/gitolite-shell
redmine_gitolite_admin_id_rsa",no-port-forwarding,no-X11-forwarding,no-agent-forwarding,no-pty
ssh-rsa ...
The issue is fixed by either adding to sshd 9 sshd_config:
HostKeyAlgorithms +ssh-rsa
PubkeyAcceptedAlgorithms +ssh-rsa
Or rebuilding the package from libssh2 git master commit dd0b5b2 "Changed NULL
check to avoid logic change"
also fix the issue. A new release later than this commit will do.
Cheers,
Alban
-- System Information:
Debian Release: 11.3
APT prefers stable-updates
APT policy: (500, 'stable-updates'), (500, 'stable-security'), (500,
'stable'), (90, 'unstable'), (90, 'testing')
Architecture: armhf (armv7l)
Kernel: Linux 5.10.0-13-armmp (SMP w/4 CPU threads)
Kernel taint flags: TAINT_UNSIGNED_MODULE
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled
Versions of packages libssh2-1 depends on:
ii libc6 2.33-7
ii libssl1.1 1.1.1n-1
ii zlib1g 1:1.2.11.dfsg-2+deb11u1
libssh2-1 recommends no packages.
libssh2-1 suggests no packages.
-- no debconf information
--- End Message ---
--- Begin Message ---
Version: 1.11.0-1
--- End Message ---
