Git Bash - ssh connection issue

Question

Environment:

OS: Windows-10
Git Bash Version: 2.33.1
OpenSSH_8.8p1, OpenSSL 1.1.1l  24 Aug 2021
$ which ssh
 /usr/bin/ssh

SSH connection to Gerrit Error:-

$ ssh -p 29418 [email protected]

Unable to negotiate with gerrit.example.com port 29418: no matching host key type found. Their offer: ssh-rsa,ssh-dss

In Git-2.32.0 ssh connection to gerrit works. Is there any restriction enabled in latest git version?

Dowell

It looks like the latest version of git is deprecating insecure algorithms and your Gerrit instance is unable to connect with more modern options – Scruple

This is not a problem with git. You have better chances to find a solution when you search for "ssh". – Hanker

Answer 1

Git For Windows 2.33.1 comes with OpenSSH 8.8 which disables RSA signatures using the SHA-1 hash algorithm by default.

For most users, this change should be invisible and there is no need to replace ssh-rsa keys.
OpenSSH has supported RFC8332 RSA/SHA-256/512 signatures since release 7.2 and existing ssh-rsa keys will automatically use the stronger algorithm where possible.

Incompatibility is more likely when connecting to older SSH implementations that have not been upgraded or have not closely tracked improvements in the SSH protocol.

For these cases, it may be necessary to selectively re-enable RSA/SHA1 to allow connection and/or user authentication via the HostkeyAlgorithms and PubkeyAcceptedAlgorithms options.
For example, the following stanza in ~/.ssh/config will enable RSA/SHA1 for host and user authentication for a single destination host:

Host old-host
   HostkeyAlgorithms +ssh-rsa
   PubkeyAcceptedAlgorithms +ssh-rsa

Note: Git for Windows 2.34.0 does not bring any new element/evolution on the SSH front.

---

Stefan Prodan (DX @weaveworks, creator of http://flagger.app and maintainer of http://fluxcd.io) mentions in this tweet:

GitHub has changed its host keys 💥

If you're using @fluxcd please see here how to update the known hosts keys on your Kubernetes clusters.

Stefan refers to fluxcd/flux2 discussion 2097:

GitHub has changed its SSH host keys from RSA to ECDSA!

To fix the key mismatch error, you have two options:

1. Update the known_hosts in the flux-system secret with the ecdsa-sha2-nistp25 value:

github.com ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEmKSENjQEezOmxkZMy7opKgwFB9nkt5YRrYMjNuG5N87uRgg6CLrbo5wAdT/y6v0mKV0U2w0WZ2YB/++Tpockg=

2. Or rotate the SSH keys with flux boostrap like so:

• delete the deploy key secret from your cluster kubectl -n flux-system delete secret flux-system
• rerun flux bootstrap github with the same arguments as before

Flux will generate the secret with ecdsa-sha2 SSH key and Host key

More details on fluxcd/source-controller#490

---

Note: since Jan. 2022, the GitHub SSH Host key are available through a metadata endpoint api.github.com/meta.
That includes the github.com ecdsa-sha2-nistp256 value.

Weldonwelfare

~/.ssh/config method also doesn't work. Still same error persisting. Even in Git Windows - 2.34.0 version also same issue. – Dowell

Just for testing, would an older version of Git work better? (2.30 for instance?) – Weldonwelfare

Yes until this Git Client version for Windows -2.32.0 it is working fine. – Dowell

@Dowell Is it possible that it is using the wrong SSH? (Windows instead of Git packaged SSH: github.com/git-for-windows/build-extra/pull/367) – Weldonwelfare

@Dowell I believe I have found a possible solution: see my edited answer and update your client ~/.ssh/known_hosts as detailed in said answer. – Weldonwelfare

Additionally added Port 29418 in the ~/.ssh/config it is working. Thanks a lot. – Dowell

@Dowell Perfect, well done! – Weldonwelfare

@Weldonwelfare How did you get the value of ecdsa-sha2-nistp256? – Dad

@Dad github.blog/changelog/… and api.github.com/meta – Weldonwelfare

Answer 2

Facing the same problem. The solution is to add the following to ~/.ssh/config

HostkeyAlgorithms +ssh-rsa    
PubkeyAcceptedAlgorithms +ssh-rsa

Cannot have Host as in the accepted answer. Must be exactly as above. I guess each server may be configured in different ways and individual may have to experiment.

Highlight

For git for Windows this lives in %USERPROFILE%\.ssh\config – Colima

I've confirmed this works on Git 2.39.1.windows.1. Both lines must be added to the top of .ssh/config as opposed to a host configuration. – Helbon

This is not a good (long-term) solution since it weakens encryption. "It is now possible to perform chosen-prefix attacks against the SHA-1 hash algorithm for less than USD$50K.". The correct solution is to switch to a different signature algorithm. – Somatic

Works for me in my WSL2. – Fisher

Answer 3

This thread was recommended to me as I was facing the same issue but was not using gerrit.

I tried using the answered solution but it didn't work for me.

So for anyone in the same situation, adding just the below line in ~/.ssh/config did resolve the issue for me.

HostkeyAlgorithms +ssh-rsa

Parable

This is not a good (long-term) solution since it weakens encryption. See my comment on toddwz's answer. – Somatic