Unsupported public key algorithm ssh-rsa: how to fix it

A research paper published in 2023 by Keegan Ryan, Kaiwen He, George A. Sullivan and Nadia Heninger mathematically demonstrated another weakness in RSA keys, which are commonly used as host keys of SSH and SFTP servers and to authenticate SSH users with PKI.

For this reason, starting from Syncplify Server! 6.2.26 the ssh-rsa algorithm is no longer among the algorithms active by default. We have done so to protect our customers and users, and to keep the reputation we earned over more than a decade as the only enterprise grade SSH and SFTP server on the market that has never been hacked.

Yet, more often than we expected, we receive emails and support tickets reporting that an SSH or SFTP client connecting to our server receives an error like this one:

Unsupported public key authentication algorithm SshRsa (ssh-rsa)

What exactly is disabled

ssh-rsa is the signature algorithm that uses an RSA key with SHA-1. What the default configuration excludes is that algorithm, both for the server's host key and for user authentication. RSA keys used with the SHA-2 signature algorithms, rsa-sha2-256 and rsa-sha2-512, are still accepted by default, so a current client with an RSA key still connects. The error above comes from a client that can only sign with ssh-rsa, that is, an old client, or an old SSH library inside some application.

The correct way to fix it

The correct fix is to ditch RSA keys completely. They should appear nowhere in your server's configuration: no RSA host key, no RSA keys to authenticate your users, and no ssh-rsa host key or PKI algorithm enabled. Then configure all of your clients to use Ed25519 keys, as described in Authenticating users with SSH keys. Yes, it is a hassle and it requires reconfiguring a lot of moving parts, but no effort is too big compared to the cost (legal, monetary and material) of being hacked.

The quick and insecure way to fix it

You can, of course, keep your RSA keys and re-enable the ssh-rsa algorithm on the server. In the Admin UI of the virtual site, open Protocols, then SFTP / SSH, go to the Advanced tab and add ssh-rsa to the PKI authentication key algorithms list (and to the Host key algorithms list if the client also needs to verify an RSA host key with it).

Keep in mind that any change to the algorithms of the SSH service takes effect only after you restart the virtual site from the SuperAdmin UI.

WARNING

While this option is offered for your convenience, it does not provide the same level of security as the recommended approach. Syncplify cannot be held responsible for any security breach that may occur as a result of using it. We strongly advise the secure option, to protect your system, your users and your data.