Could not disable ssh-rsa in gitlab-ssh
I am trying to disable ssh-rsa algorithm for public key in gitlab-ssh, but without success.
gitlab_sshd['public_key_algorithms'] in gitlab.rb is set like this:
gitlab_sshd['public_key_algorithms'] = ['ecdsa-sha2-nistp256', 'ecdsa-sha2-nistp384', 'ecdsa-sha2-nistp521', 'ssh-ed25519', 'rsa-sha2-256', 'rsa-sha2-512']It also looks like correct config is generated:
sshd: {"concurrent_sessions_limit":100,"proxy_protocol":true,"proxy_policy":"use","proxy_header_timeout":"500ms","grace_period":55,"client_alive_interval":null,"ciphers":null,"kex_algorithms":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521"],"macs":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"public_key_algorithms":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","rsa-sha2-256","rsa-sha2-512"],"login_grace_time":60,"host_key_files":["/var/opt/gitlab/gitlab-sshd/ssh_host_ecdsa_key","/var/opt/gitlab/gitlab-sshd/ssh_host_ed25519_key","/var/opt/gitlab/gitlab-sshd/ssh_host_rsa_key"],"host_key_certs":[],"listen":"[::]:2222","web_listen":"localhost:9122"}And even log when starting SSH server looks good:
{"correlation_id":"XXXX","level":"info","msg":"Listening for SSH connections","supported_public_key_algorithms":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","rsa-sha2-256","rsa-sha2-512"],"tcp_address":"0.0.0.0:2222","time":"XXX"}But nmap stills shows ssh-rsa as supported algorithm:
PORT STATE SERVICE
2222/tcp open EtherNetIP-1
| ssh2-enum-algos:
| kex_algorithms: (6)
| curve25519-sha256
| curve25519-sha256@libssh.org
| ecdh-sha2-nistp256
| ecdh-sha2-nistp384
| ecdh-sha2-nistp521
| kex-strict-s-v00@openssh.com
| server_host_key_algorithms: (5)
| ecdsa-sha2-nistp256
| ssh-ed25519
| rsa-sha2-256
| rsa-sha2-512
| ssh-rsa
| encryption_algorithms: (6)
| aes128-gcm@openssh.com
| aes256-gcm@openssh.com
| chacha20-poly1305@openssh.com
| aes128-ctr
| aes192-ctr
| aes256-ctr
| mac_algorithms: (4)
| hmac-sha2-256-etm@openssh.com
| hmac-sha2-512-etm@openssh.com
| hmac-sha2-256
| hmac-sha2-512
| compression_algorithms: (1)
|_ noneVersion used: gitlab-ce-17.6.2-ce.0.el8.src.rpm
Edited by Jakub Onderka