-1

I have two Raspberry Pis, both running Raspbian Buster, both set up with full disk encryption, with dropbear (version 2018.76-5) to support remote unlocking of the disk encryption. This has been working fine for years. However, recently dropbear has stopped accepting my SSH key, and I now get

root@<address>: Permission denied (publickey).

when I try to unlock remotely. I have not made any configuration changes. The contents of the authorized_keys file in the initramfs is correct. The most recent evidence I can find of having successfully done a remote unlock is 10th March for both RPis. Really strangely, the modified date of the initramfs confirms that the initramfs file has not been modified since the last successful remote unlock! Specifically, on the RPi I'm working on now, on 10th March, initramfs was regenerated at 09:38 following a kernel update (and has not been modified since), RPi was rebooted at 09:40, and successfully remotely unlocked at 09:44.

Edit: I have now experimented with generating fresh DSA, ECDSA, ED25519, RSA 2048-bit, RSA 3072-bit, and RSA 4096-bit SSH keys, and adding them all to the authorized_keys file, and regenerating the initramfs. Having done so, I am able to connect with the ECDSA key, but not any of the other keys. Previously, I was using an RSA 2048-bit key with one RPi, and an RSA 3072-bit key with the other RPi. So, from my experience here, it appears Dropbear stopped accepting RSA 2048- and 3072-bit keys (and possibly some other types) at some point between 10th March 2022 and 12th June 2022 (when I first found I couldn't connect), without any updates to the dropbear binaries or configuration?!?

4
  • And mine dropbear doesn't do this. Strange. Probably, you need to include log messages from server side, and also try ssh -v (or more v's) to increase verbosity? Jun 27, 2022 at 10:24
  • Ah, got it – it's a client ssh difference! In between those times, I upgraded from Kubuntu 20.04 to Kubuntu 22.04. If I run a 20.04 docker container, and use the same SSH key, I'm able to connect. So, something in how the SSH in Kubuntu 22.04 tries to connect with RSA keys is not supported by the dropbear in Debian Buster. Jun 27, 2022 at 10:45
  • ssh -vv would reveal that. For example, see OpenSSH release notes Jun 27, 2022 at 10:49
  • Most likely it is because OpenSSH 8.8 disables ssh-rsa by default, you can change that in the configuration of client and/or server depending on which one is the culprit. There's a newer RSA method rsa-sha2-256 that replaces it. It replaces SHA-1 hashing by SHA-2.
    – starblue
    Mar 11 at 16:10

1 Answer 1

2

Dropbear is an implementation of OpenSSH. I encountered a similar issue around the same time after a Bullseye update where OpenSSH (version 7 onwards I think) stopped supporting RSA key types. I had to change the key type to a more modern cipher. I migrated over to Ed25519 and it works as expected now. Though I haven't used Dropbear in my instance I suspect this is the root cause in your case.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .