Publisher Configuration and Hardening

Remove ssh-rsa from Publisher SSH Configurations for Better Security

Starting from Publisher R122, the prebuilt images remove ssh-rsa from three SSH daemon (sshd) configurations to improve security.

HostbasedAcceptedKeyTypes -ssh-rsa
HostKeyAlgorithms -ssh-rsa
PubkeyAcceptedKeyTypes -ssh-rsa

Description for these settings:

• HostbasedAcceptedKeyTypes: Defines which signature algorithms are allowed for host-based authentication. Publisher disables host-based authentication by default, so removing ssh-rsa here is an extra security measure.
• HostKeyAlgorithms: Defines which signature algorithms the server can use to identify itself.
• PubkeyAcceptedKeyTypes: Defines which public key types clients can use and servers will accept.

Note that ssh-rsa is now considered insufficiently secure for these configurations, and modern SSH clients avoid using it by default. For Existing Publishers, there are two methods to avoid weak algorithms.

Method 1: Disable ssh-rsa in SSH daemon settings

1. Edit the SSH configuration file.

   sudo vi /etc/ssh/sshd_config

2. Add these three lines:

   HostbasedAcceptedKeyTypes -ssh-rsa
   HostKeyAlgorithms -ssh-rsa
   PubkeyAcceptedKeyTypes -ssh-rsa

3. Restart the SSH daemon:

   sudo service sshd restart

   This prevents the SSH server from accepting any ssh-rsa related settings.

Method 2: Force the SSH client to use secure algorithms. If you prefer not to modify Publisher settings, you can configure your SSH client.

1. Check your known hosts file on your local machine:

   vi ~/.ssh/known_hosts

2. Look for entries using ssh-rsa, such as:

   192.168.18.133 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDnhBRNmn23Klj...........

3. Remove that line and save the file.