Connect Lost on CentOS stream 9 hosts

Hi team! We are testing on some hosts newly upgraded to CentOS stream 9 with openssl3. And we found we are not able to connect to those hosts with asyncssh while we can use the same cert ssh to it by just running ssh <hostname>.

We got connect lost error from asyncssh connection and following is the detailed logs.

2022-03-24 11:31:47,365 DEBUG    [asyncssh] [conn=0] Received key exchange request
2022-03-24 11:31:47,365 DEBUG    [asyncssh] [conn=0]   Key exchange algs: curve25519-sha256,[e-mail],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256
2022-03-24 11:31:47,366 DEBUG    [asyncssh] [conn=0]   Host key algs: rsa-sha2-512,rsa-sha2-256,ssh-rsa,[e-mail],[e-mail],[e-mail]
2022-03-24 11:31:47,366 DEBUG    [asyncssh] [conn=0]   Client to server:
2022-03-24 11:31:47,366 DEBUG    [asyncssh] [conn=0]     Encryption algs: [e-mail],[e-mail],[e-mail],aes128-ctr,aes192-ctr,aes256-ctr
2022-03-24 11:31:47,366 DEBUG    [asyncssh] [conn=0]     MAC algs: [e-mail],[e-mail],[e-mail],[e-mail],hmac-sha2-256,hmac-sha2-512
2022-03-24 11:31:47,366 DEBUG    [asyncssh] [conn=0]     Compression algs: none,[e-mail]
2022-03-24 11:31:47,366 DEBUG    [asyncssh] [conn=0]   Server to client:
2022-03-24 11:31:47,366 DEBUG    [asyncssh] [conn=0]     Encryption algs: [e-mail],[e-mail],[e-mail],aes128-ctr,aes192-ctr,aes256-ctr
2022-03-24 11:31:47,366 DEBUG    [asyncssh] [conn=0]     MAC algs: [e-mail],[e-mail],[e-mail],[e-mail],hmac-sha2-256,hmac-sha2-512
2022-03-24 11:31:47,366 DEBUG    [asyncssh] [conn=0]     Compression algs: none,[e-mail]
2022-03-24 11:31:47,367 DEBUG    [asyncssh] [conn=0] Beginning key exchange
2022-03-24 11:31:47,367 DEBUG    [asyncssh] [conn=0]   Key exchange alg: curve25519-sha256
2022-03-24 11:31:47,367 DEBUG    [asyncssh] [conn=0, pktid=1] Sent MSG_KEX_ECDH_INIT (30), 37 bytes
  00000000: ...<some bytes>
  00000010: ...<some bytes>
  00000020: ...<some bytes>  
2022-03-24 11:31:47,387 INFO     [asyncssh] [conn=0] Connection lost
2022-03-24 11:31:47,387 INFO     [asyncssh] [conn=0] Aborting connection

And on the target host side we got fatal: mm_answer_sign: sign: error in libcrypto.

Here is how I use asyncssh to connect.

priv_path = "somepaht"
cert_path = priv_path + "-cert.pub"
privkey = asyncssh.read_private_key(priv_path)
cert = asyncssh.read_certificate(cert_path)

options = asyncssh.SSHClientConnectionOptions(
    username="root",
    client_keys=[(privkey, cert)],
    known_hosts=None,
    x509_trusted_certs=None,
    # signature_algs="rsa-sha2-512",  # I tried with and without this line. Both are failed
)

async with asyncssh.connect(
    "hostname>"
    port=22,
    options=options,
) as conn:
    result = await conn.run("ls /")
    logging.info(" --- ".join(result.stdout.splitlines()))

Any help is appreciated! Thanks!

[ronf]

Thank you for the confirmation, and for helping me work though this…

[ronf]

Ok - I did some testing here, against a server with ssh-rsa disabled, and I was able to reproduce the “Connection reset by peer” before this change and getting it to work after the change. I’m still not sure why OpenSSH didn’t fall back from the disabled certificate algorithm to one of the supported host key algorithms, but with this change that is no longer necessary. After this change, if you have an RSA host key with a certificate on the server, AsyncSSH will be able to use SHA-2 signature algorithms with that key and validate the cert’s public key rather than the host’s public key in known_hosts.

Thanks for the report on this! I’ll be checking this change in shortly, and am hoping to do a release later today if all goes well.