unixopensslssh-keysopensshssh-keygen

Generate a DSA key pair with 2048 bit - add to the authorized_keys


My first attempt since ssh-keygen doesn't support dsa with size of 2048 (DSA keys must be 1024 bits), was to generate one with the size of 1024 (with no password):

$ ssh-keygen -b 1024 -t dsa

id_dsa
id_dsa.pub

then used the command ssh-copy-id to add the key to my authorized_keys.

ssh-copy-id -i ~/.ssh/id_dsa.pub user@host

at the end as suggested tried the ssh user@host with success without being request any password.

https://www.ssh.com/academy/ssh/keygen

But since 1024 is not recommended and the minimal requested is 2048, tried searching using openssl instead that does support the 2048 for dsa format.

Found the following 'tutorial': https://www.howtouselinux.com/post/create-rsa-dsa-key-with-openssl how to generate the keys using openssl

$ openssl dsaparam -out dsaparam.pem 2048
$ openssl gendsa -out dsaprivkey.pem dsaparam.pem

with this two commands creates the private key in the file dsaprivkey.pem

to get the public key

$ openssl dsa -in dsaprivkey.pem -outform DER -pubout -out dsapubkey.der

Now my problem was how to integrate this key's into to my authorized_keys the public and the private was already in /.ssh folder that generated directly.

At this point not sure if this is the correct approach since to me openssl is used more in the context of generating certificates to install and permit the HTTPS communication and not much to do with authentication using the public and private keys as openssh...

but still tried using as example to convert the pem file into a public key using the command suggested

ssh-keygen -y -f dsaprivkey.pem > dsa_pubkey.pub

and with this public key dsa_pubkey.pub could use with ssh-copy-id, but still was in doubt if .pem file should be the private key as the one used or should it be public key instead but again read somewhere that dsaprivkey.pem should in fact contains both the keys

$ openssl dsa -in dsaprivkey.pem -outform DER -pubout -out dsapubkey.der

that makes some sense since the public key was generated using the private as input.

after the step ssh-copy-id

ssh-copy-id -f -i ~/.ssh/dsa_pubkey.pub user@host

but now the ssh user@host requests the password so it means its not working with this new dsa 2048 keys.

Can some give some light to what steps are wrong or if this is even possible?? since its seems to me to be redundant to use openssl to generate the dsa 2048 keys just to later on convert using ssh-keygen that doesn't support 2048 in the first place...


Thanks for the answers, gona follow as sugested here and use the rsa that is already was what was inclined to use from the beginning...


Solution

  • As written by @dave_thompson_085, OpenSSH ssh and sshd do support all DSA sizes allowed by OpenSSL/libcrypto, but ssh-keygen can only generate ssh-dss keys with 1024 bits. So the reason why the 2048-bit ssh-dss key didn't work for you may be because it was disabled in the configuration of ssh or sshd. @dave_thompson_085 also wrote: OpenSSH 7.0 up by default disables ssh-dss for all sizes, and larger (186-3) sizes still use SHA-1 which is no longer considered secure.

    So may may want to run ssh -vvv user@host, and post the output to your question. It will reveal which key is used, which keys ssh offers and which keys sshd supports.

    You may want to use ssh-ed25519 keys (always 128 bits, secure) or ssh-rsa2 keys (any number of bits, at least 3072 bits is recommended for good security) or ssh-rsa keys (with SHA-1) for OpenSSH sshd older than 8.8 (ssh-rsa disabled by default in OpenSSH 8.8) instead with OpenSSH. See also reasons why ssh-dss keys are insecure.