LINUX随笔十 SFTP不支持 ssh-dss,ssh-rsa

Posted 2022-04-13 哭泣的馒头

问题描述
[root@k8s01]# sftp -P 20001 test@192.168.10.128
Unable to negotiate with 192.168.10.128 port 20001: no matching host key type found. Their offer: ssh-dss,ssh-rsa
Connection closed.  
Connection closed

根本原因之所以报错是因为OpenSSH7.0以后的版本不再支持ssh-dss(DSA)算法,官方的说法是这个算法太弱了。MACOS升到10.12附带的openssh
版本是7.4,如下:➜~sshd-Vsshd:illegaloption--VOpenSSH_7

解决方案：
命令行里添加选项 
ssh -oHostKeyAlgorithms=+ssh-dss 
添加 HostKeyAlgorithms +ssh-dss到配置 ~/.ssh/config 

###sftp添加这个参数
[root@k8s01]# sftp -P 20001 -oHostKeyAlgorithms=+ssh-dss test@192.168.10.128
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@    WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!     @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that a host key has just been changed.
Please contact your system administrator.
Add correct host key in /root/.ssh/known_hosts to get rid of this message.
Offending RSA key in /root/.ssh/known_hosts:40
Host key for [192.168.10.128]:20001 has changed and you have requested strict checking.
Host key verification failed.

###删除某个文件
[root@k8s01]# rm /root/.ssh/known_hosts
rm: remove regular file ‘/root/.ssh/known_hosts’? y

[root@k8s01]# sftp -P 20001 -oHostKeyAlgorithms=+ssh-dss test@192.168.10.128
The authenticity of host [192.168.10.128]:20001 ([192.168.10.128]:20001) cant be established.
This key is not known by any other names
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added [192.168.10.128]:20001 (DSA) to the list of known hosts.
test@192.168.10.128s password: 
Connected to 192.168.10.128.
sftp>

最终解决办法：

添加 HostKeyAlgorithms +ssh-dss到配置 ~/.ssh/config
再执行
sftp -P 20001 test@192.168.10.128 ##就可以了，可以脚本运行了