microsoft / microsoft/vscode

Agents window: SSH fails with "no matching host key format" on hosts using OpenSSH host certificates

Open
#325,647 1 comment 2 reactions 0 assignees View on GitHub
Dominant language
TypeScript
Stars
193k
Forks
42.4k
PR merge metrics
PR metrics pending

Description

Does this issue occur when all extensions are disabled?: Yes

- VS Code Version: 1.128.0
- OS Version: macOS Tahoe

The Agents window cannot open a Remote > SSH workspace on a host that presents an OpenSSH host certificate. It fails at host key negotiation with:

```
[SSHRemoteAgentHost] SSH connection error: Handshake failed: no matching host key format
```

The same host connects fine with the Remote-SSH extension, which uses the system `ssh` binary. The error text matches the Node `ssh2` library, which does not support `*-cert-v01@openssh.com` host keys, so it looks like the Agents window uses `ssh2` rather than system `ssh`.

Steps to Reproduce:

1. Configure sshd to present a host certificate. Minimal setup:
```
ssh-keygen -f ca -C ca
ssh-keygen -s ca -h -I host -n myhost /etc/ssh/ssh_host_ed25519_key.pub
# sshd_config:
# HostKey /etc/ssh/ssh_host_ed25519_key
# HostCertificate /etc/ssh/ssh_host_ed25519_key-cert.pub
# HostKeyAlgorithms ssh-ed25519-cert-v01@openssh.com
echo "@cert-authority myhost $(cat ca.pub)" >> ~/.ssh/known_hosts
2. Confirm the Remote-SSH extension connection to the host.
3. Run "Chat: Open Agents Window", then New > Remote > SSH, and select the host.

Expected: connects like Remote-SSH does.
Actual: connection fails with the host key error above and never reaches the remote.

I could not find a setting to make the Agents window use system `ssh` (`remote.SSH.path` applies to the Remote-SSH extension).
Related but different root cause: #315870 (process startup), #324081 / #317549 (client auth).

Contributor guide

Open the contributing guide

Research direction

Reproduce the failure using the provided sshd host-certificate setup, then trace the Agents window's Remote > SSH connection path and the Node ssh2 host-key handling implicated by the error. Compare it with the Remote-SSH extension's system ssh behavior. Done means the Agents window opens the remote workspace on a host presenting an OpenSSH certificate.

Written by the indexing model from the issue text.

Assessment

Tech stack
node.js, typescript
Domain
developer-experience, networking
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
50/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.