Connection failed to Fedora 33 SSH/SFTP server

[Vitaly Zaitsev]

Description of problem:
Cannot connect to the OpenSSH server on Fedora 33 due to recent crypto-policy changes with using standard RSA-4096 keys (curve25519 works).

I can also reproduce this issue with FileZilla on Windows 10 and even in PuTTY client.

Version-Release number of selected component (if applicable):
filezilla-3.51.0-1.fc33
libfilezilla-0.25.0-2.fc33

How reproducible:
Always.

Steps to Reproduce:

1. Install Fedora 33.
2. Install OpenSSH server: sudo dnf install openssh-server
3. Enable it: sudo systemctl enable --now sshd.service
4. Disable password authentication:

echo "PasswordAuthentication no" | sudo tee /etc/ssh/sshd_config.d/00-disablepass.conf
sudo chmod 0600 /etc/ssh/sshd_config.d/00-disablepass.conf

5. Restart OpenSSH server: sudo systemctl restart sshd.service
6. Create SFTP connection in FileZilla to 127.0.0.1.
7. Try to connection with RSA key authentication (id_rsa should be added to the SSH agent).

Actual results:
Connection failure:
FATAL ERROR: No supported authentication methods available (server sent: publickey)

Expected results:
Successful connection.

Additional info:
Logs attached:

• filezilla.log - internal FileZilla log file with full debug enabled;
• sshd-filezilla.log - OpenSSH Server log with debug for the FileZilla connection;
• sshd-console-client.log - OpenSSH Server log with debug for the default console SSH client.

[Tim Kosse]

You are trying to authenticate with a key type (ssh-rsa) not supported by the server.

The working login shows an authentication attempt with a different key type (rsa-sha2-256).

Make sure to load a key type supported by the server in your agent.

[Vitaly Zaitsev]

I use the same key both in FileZilla and console OpenSSH client.

OpenSSH client can connect, FileZilla - cannot.

[Vitaly Zaitsev]

I think this ticket need to be reopened.

The same server, SSH key, SSH agent running and two different clients: FileZilla and the default console SSH client. FileZilla cannot connect, but the console client works absolutely fine.

I guess this issue is related to the PuTTY libraries. I have absolutely the same problem with PuTTY 0.74 on Windows 10 and the same SSH RSA key.

[Tim Kosse]

There are multiple different keys involved. Make sure to use the same key in all your tests.

[Vitaly Zaitsev]

I have only one key. The same server, SSH key, SSH agent running and two different clients: FileZilla and the default console SSH client.

Just take Fedora 33 live, boot from it, generate RSA key, disable password authentication and you will easily reproduce this issue.

[Tim Kosse]

You are trying to authenticate with a key type (ssh-rsa) not supported by the server.
The working login shows an authentication attempt with a different key type (rsa-sha2-256).

A key cannot simultaneously be of two types, which means that you are using multiple keys.

Make sure to use the same key in all clients, then it behaves the same in all clients: Either all connect, or none connect.