[cfarm-users] Automated deployment across multiple cfarm hosts

[Jacob Bachmeyer]

Martin Guy via cfarm-users wrote:
> On 15/09/24 11:40, Peter Gutmann via cfarm-users wrote:
>> Jonathan Wakely <jwakely.gcc at gmail.com> writes:
>> SSH_ARGS="-o PubkeyAcceptedAlgorithms=+ssh-rsa -o 
>> KexAlgorithms=+diffie-hellman-group-exchange-sha1 -o 
>> HostKeyAlgorithms=+ssh-rsa -o StrictHostKeyChecking=no"
>
> Thanks. I've now set these in .ssh/config but got
>
>     Bad server host key: Invalid key length
>
> fixed by adding
>
>     -o RequiredRSASize=512

OK, now *that* is a problem, but trying a connection with "ssh -vvvv" 
suggests ("bits set: 497/1024" while checking the host key) that "-o 
RequiredRSASize=1024" should also work.

512-bit RSA is definitely breakable and should not be used for a 
long-term key.  768 bits is also too short; 1024 is currently marginal 
and definitely not suitable for a high-value target, but impersonating a 
cfarm host will not get an attacker much other than (eventually) 
caught.  User authentication at the CFarm is by SSH public keys, so an 
attacker should not expect to be able to eavesdrop a valuable password.  
It /might/ be something we could safely let slide.

Nonetheless, would rotating cfram210 to a longer (2048 or 4096) bit RSA 
host key be possible with its current sshd?  I know it accepts a 
4096-bit RSA user key; mine is that long.  If done, it would be very 
nice to announce the old and new fingerprints on the mailing list, so 
everyone knows to expect ssh to complain loudly about a key mismatch, or 
even can directly update known_hosts ("change 'this' key to 'this' much 
longer key on whatever line has it").


-- Jacob