element-hq / element-hq/synapse
The manhole's hardcoded private key uses a very outdated signature type
- Dominant language
- Python
- Stars
- 4.6k
- Forks
- 600
- Avg merge
- 5d 22h
- Merged PRs (30d)
- 51
Description
This issue has been migrated from [#12629](https://github.com/matrix-org/synapse/issues/12629).
---
The manhole has a hard-coded private key (https://github.com/matrix-org/synapse/issues/3850) which uses the `ssh-rsa` signature type. This refers to a combination of RSA and SHA-1, and is now quite outdated.
In fact it's so outdated, that newer versions of OpenSSL will now refuse to connect:
```
$ ssh -p9000 matrix@localhost
Unable to negotiate with ::1 port 9000: no matching host key type found. Their offer: ssh-rsa
```
(`ssh-rsa` was [deprecated in OpenSSL v8.2](https://www.openssh.com/txt/release-8.2), and [disabled in OpenSSL v8.8](https://www.openssh.com/txt/release-8.8)). We should (at least) use a key with a more up-to-date signature algorithm.
---
A workaround, if needed, is to add the following to your `~/.ssh/config`:
```
Host
PubkeyAcceptedAlgorithms +ssh-rsa
HostkeyAlgorithms +ssh-rsa
```
Contributor guide
Assessment
This issue has not been assessed yet.