element-hq / element-hq/synapse

The manhole's hardcoded private key uses a very outdated signature type

Open
#12,629 0 comments 0 reactions 0 assignees View on GitHub
S-Minor T-Defect
Dominant language
Python
Stars
4.6k
Forks
600
Avg merge
5d 22h
Merged PRs (30d)
51

Description

This issue has been migrated from [#12629](https://github.com/matrix-org/synapse/issues/12629).

---

The manhole has a hard-coded private key (https://github.com/matrix-org/synapse/issues/3850) which uses the `ssh-rsa` signature type. This refers to a combination of RSA and SHA-1, and is now quite outdated.

In fact it's so outdated, that newer versions of OpenSSL will now refuse to connect:

```
$ ssh -p9000 matrix@localhost
Unable to negotiate with ::1 port 9000: no matching host key type found. Their offer: ssh-rsa
```

(`ssh-rsa` was [deprecated in OpenSSL v8.2](https://www.openssh.com/txt/release-8.2), and [disabled in OpenSSL v8.8](https://www.openssh.com/txt/release-8.8)). We should (at least) use a key with a more up-to-date signature algorithm.

---

A workaround, if needed, is to add the following to your `~/.ssh/config`:

```
Host
PubkeyAcceptedAlgorithms +ssh-rsa
HostkeyAlgorithms +ssh-rsa
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.