4

I have a PHP tool that needs SSH access to some of my servers. This is an internal only application and it works 100% fine when talking to Ubuntu 18.04 machines.

I started updating my machines to 22.04 and every machine on 22.04 now gives the error message "Unable to exchange encryption keys" when I try to open an SSH connection using PHP and ssh2_connect().

I am able to SSH using the security keys and user when I am in the CLI and try accessing as if the web server is launching ssh.

sudo -u www-data ssh -i [path-to-private-key] [user]@[ip-address]

I have a server running PHP 7.2 and one running 7.4 and both give the same error, but only when talking to Ubuntu 22.04 machines.

This is the command giving me the error:

$this->_CON = ssh2_connect($sshHost, $sshPort, [ 'hostkey' => 'ssh-dss,ssh-rsa' ]);

This will make the connection but of course will not allow the user of keys:

$this->_CON = ssh2_connect($sshHost, $sshPort);

Any thoughts?

---- UPDATE ----

Ok, I just updated another server to 22.04 and instantly ssh2_connect failed to talk to that server. So I am convinced it is something that is wrong with the 22.04 servers not the php server. I just need to figure out which package has changed. Maybe some configuration file causing the key exchange to work differently.

This only happens through the php ssh2_connect process. Not when directly using the ssh command on the command line even when using the same keys.

2 Answers 2

7

AH HA!!!!!!

I found the solution. The issue is the key exchange process of "ssh-rsa" is not accepted on Ubuntu 22.04 systems. I switched to using "ecdsa-sha2-nistp256" and it works!

This code now works when being run from PHP 7.2, 7.4 and 8.1 (tested on all three) and from Ubuntu 18.04, 20.04 and 22.04 servers (again, tested on all)

$con = ssh2_connect($hostAddr, $hostPort , [ 'hostkey' => 'ecdsa-sha2-nistp256,ssh-rsa']);

I am very happy!

To see how your SSH server is configured you can run this command:

grep "HostKey" /etc/ssh/sshd_config

To see the key exchange names you can look at the head of each public key like this:

head /etc/ssh/ssh_host_*.pub

You will find the key exchange name on the start key line.

I also had to create some logic to know which servers I am connecting to. Those still using the RSA connection need to use RSA keys to make the SSH connection. Those using the ECDSA connection need new ECDSA keys.

You can create the new keys by running this command and then append the public key it to the authorized_keys on each server.

ssh-keygen -t ecdsa-sha2-nistp256
4
  • 1
    Hiya, I have tried the above and i am getting nowhere. There is very little on the web also. Can you elaborate any more as i have followed these instructions and still get the same error
    – Liam
    Sep 21, 2022 at 9:26
  • Sorry, beyond what I mentioned here I have no advice. These steps are working for me and I have 5 servers using ECDSA keys and 2 using RSA keys. My controller script that does the automated SSH processes switches between the two modes based on the server being accessed.
    – schworak
    Sep 26, 2022 at 0:02
  • Forcing hostkey to another value than ssh-rsa (that is no more supported by default by the ssh server on Ubuntu 22.04), as suggested by @schworak, may work ONLY if the new value of hostkey is a known value of your version of libssh2.so (the lib used by PHP). This is not the case with version of Ubuntu lower before 22.04. So i think you must also upgrade the libssh2 lib used by your PHP to version 1.9 or 1.10 (instead of 1.8 or lower with ubuntu 20.04 for example).
    – Eldy
    Oct 7, 2022 at 15:25
  • A solution on server side is to add HostKeyAlgorithms +ssh-rsa into your /etc/ssh/sshd_config to accept ssh-rsa. But warning this is less secured than a more recent auth method.
    – Eldy
    Oct 7, 2022 at 15:30
3

Add these lines to /etc/ssh/sshd_config

HostKeyAlgorithms +ssh-rsa
PubkeyAcceptedKeyTypes +ssh-rsa

and restart sshd

sudo systemctl restart sshd
1
  • This worked when combined with the answer by @schworak May 23, 2023 at 14:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .