On Sat, 21 Nov 2020, [email protected] wrote:
Hi
On Sat, 21 Nov 2020 14:14:23 -0500 Max Pyziur wrote:
Even though I had done the F33 upgrade sometime ago, I am only now seeing
that it appears to have affected my rsync backups. When my CentOS server
issues the rsync backup the following error appears:
no hostkey alg
rsync: connection unexpectedly closed (0 bytes received so far) [receiver]
rsync error: unexplained error (code 255) at io.c(600) [receiver=3.0.6]
Seen that.
You have to change the configuration of sshd on your F33 machine.
I've chosen to not modify the crypto policies, but to enable ssh-rsa with a
snippet under /etc/ssh/sshd_config.d/
-------------------- /etc/ssh/sshd_config.d/20-NAME.conf ---------
# To load *before* 50-redhat.conf
# From /etc/crypto-policies/back-ends/opensshserver.config
# then add ,ssh-rsa No +ssh-rsa allowed (seems)
HostKeyAlgorithms
ecdsa-sha2-nistp256,[email protected],[email protected],[email protected],ecdsa-sha2-nistp384,[email protected],ecdsa-sha2-nistp521,[email protected],ssh-ed25519,[email protected],[email protected],[email protected],rsa-sha2-256,[email protected],rsa-sha2-512,[email protected],ssh-rsa
# Weird: this +ssh-rsa works here.
# The setting (without +) in
# /etc/crypto-policies/back-ends/opensshserver.config
# do not lose this +ssh-rsa
PubkeyAcceptedKeyTypes +ssh-rsa
----------------------------------------------------------------------
The 20- prefix is needed to be alphabetically before 50-redhat.conf
that loads/include /etc/crypto-policies/back-ends/opensshserver.config
Thank you for your reply. I'll review this.
In the meantime, for the sake of expediency, I've issued the following
command on the client F33 machines as root:
update-crypto-policies --set LEGACY
Once executed, it says that the machine needs to be rebooted for the
policies to properly go into effect.
This has caused the rsync backup that I have in place to function.
But in the current world, tougher rather than looser encryption is better.
Thank you again,
Max
_______________________________________________
users mailing list -- [email protected]
To unsubscribe send an email to [email protected]
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedoraproject.org/archives/list/[email protected]
