@Andrew said:
@gduperrey The new OpenSSL/SSH blocks existing/working RSA keys from older SSH clients. While you can still use a password for SSH, it will block old keys from working which will break things (not good for existing LTS installs). To maintain compatibility add PubkeyAcceptedAlgorithms +ssh-rsa to /etc/ssh/sshd_config
Hi @andrew, thank you for your feedback, the fallback option you're suggesting will work but it will downgrade the security of your system, we suggested to update clients:
"Note that older ssh-clients (with weak ciphers) will need to update, if connection is rejected."
Let me make it more explicit that older keys should be also refreshed:
ssh-keygen # To generate new $identity_file
ssh-copy-id \
-i $identity_file \
-o HostKeyAlgorithms=+ssh-rsa \
-o PubkeyAcceptedAlgorithms=+ssh-rsa \
$user@$host
ssh $user@$host
Ideally this can be done before the update, but let's us think if we have a better strategy to provide a smoother experience, meanwhile if anyone is curious check:
https://www.openssh.org/releasenotes.html
