1

I have an EC2 instance authenticated with a key-pair generated by AWS.

With Putty, I can connect to the instance by providing the private key in a PPK file.

When I try to use SSH2 (via one of the NodeJs wrappers, e.g. through the 'ssh2-sftp-client' module), it fails with an error:

getConnection: All configured authentication methods failed

And the auth.log on the instance reports,

sshd[1841]: userauth_pubkey: key type ssh-rsa not in PubkeyAcceptedAlgorithms [preauth]

I know that OpenSSH has deprecated ssh-rsa but I am still not sure what is wrong here:

  • ssh-rsa seems to mean a number of things, and it appears only SHA1 has been deprecated. My key is SHA256 as reported by PuttyGen however so should still work, no?
  • If I understand right, changing from ppk to pem just changes the layout and encoding of the file, not the key value itself. If the OpenSSH server is the one doing the rejection, why does Putty work OK?

Does converting from PPK to PEM change the type of the key? If so, how can I convert PPK to PEM into something other than ssh-rsa?

The SSH (server) version is OpenSSH_8.9p1 Ubuntu-3, OpenSSL 3.0.2 15 Mar 2022

-- Edit because I can't comment yet --

@Tanjin Alam's answer is correct, and in AWS this can be done automatically when the machine is built by adding the following text to the User Data field in the launch template:

#!/bin/bash
sed -i '$aPubkeyAcceptedKeyTypes=+ssh-rsa' /etc/ssh/sshd_config
service sshd restart
1
  • Add output of ssh -fNvv user@host |& grep "debug.*host key algorithms" to check what algorithms supported by server
    – gapsf
    Jul 27, 2022 at 16:36

1 Answer 1

1

Goto

/etc/ssh #goto this directory
sudo nano sshd_config #edit the file
PubkeyAcceptedKeyTypes=+ssh-rsa #add this line and save and quit 
sudo systemctl restart sshd #restart sshd

Try again it will work

Reference : Click HERE

1
  • Be aware that by doing this, you are allowing sha1 RSA authentication, which is considered weak. Dec 6, 2022 at 7:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.