Hi All

I've just started to upgrade by couple of routers running 1.3.4 and have found an issue with 1.4rc1.

For security reasons for one of my instances I've disabled SSH password authentication and only user certificates. However, in 1.4rc1, despite the config accepting the certificate, it seems the algorithm isn't enabled with sshd.

Here are the lines of my config:

set system login user chris authentication public-keys chris@router key 'blah blah'
set system login user chris authentication public-keys chris@router type 'ssh-rsa'
set service ssh disable-password-authentication

but I get the following error in the log when I try to connect:

sshd[7380]: userauth_pubkey: signature algorithm ssh-rsa not in PubkeyAcceptedAlgorithms [preauth]

It seems there's been a change in sshd which disabled some old algorithms by default, so luckily the error message is self explanatory and if I add the following line to /run/ssh/sshd_conf, all works again (I also re-enabled password authentication before the upgrade just in case so I could log in):

PubkeyAcceptedAlgorithms +ssh-rsa

..so as part of 1.4 it might be a good idea to consider adding the above in the config upgrades, or add the option in the CLI (I couldn't seem to find it) and add if found in the existing config.

Thanks

Chris..