Add ssh-rsa to 17.1.1 host key algorithm

Question

&nbsp;Hello,I've recently upgraded a HA pair of LTM devices to 17.1.1 and found out that I can no longer access the devices through 3rd party software SSH connection. I've been searching for the articles to resolve the issue but they only say I should upgrade the SSH connecting software or revise the settings of it which I can't since other network devices are connected as well.I doubt this is because the OS versions later than 17.1.0 no longer support ssh-rsa.Is there any way to add ssh-rsa to the device without changing anything on the 3rd party product?

michael_saleem · Accepted Answer

Good find.
Unfortunately, I do not think there is any alternative way. The only thing I can think of is possibly proxying the SSH client connection via a Jumphost server which supports the ssh-rsa host key algorithm.
You may want to create a Support Case with F5 to see if they are able to provide any further suggestions.

michael_saleem · Answer

The following knowledge articles may help:
Modifying the host key algorithms used by the ssh server on the BIG-IP (f5.com)Modifying the list of ciphers and MAC and key exchange algorithms used by the SSH service on the BIG-IP or BIG-IQ systems (f5.com)

phatanhappy · Answer

I would check this:bashgrep&nbsp; "IFS"&nbsp; &nbsp;/bin/scp-checkfpIF - you have&nbsp; "&nbsp; &nbsp; --- it should be changed to&nbsp; &nbsp;'&nbsp;will not effect traffic flow - and should fix without restarting anything.
process:mount -o remount,rw /usrvi /bin/scp-checkfpsearch for : IFS=$"
"change to " IFS=$'
'mount -o remount,ro /usr

pilow · Answer

&nbsp;Hi,Thank you for your support.I tried editing the sshd_config file manually but still didn't work.I found out a few more articles and turned out that F5 removed support of ssh-rsa even though I can still see BIG-IP with 17.1.1 using ssh-rsa through a command "sshd -T | grep -i hostkeyalgorithms"&nbsp;Reference:https://my.f5.com/manage/s/article/K000136120https://my.f5.com/manage/s/article/K000135559&nbsp;I know it's tough but I'm asking if there is any other way to make it work besides updating the 3rd party software.

Forum Discussion

Add ssh-rsa to 17.1.1 host key algorithm

4 Replies

Recent Discussions

BIG-IP DNS: Check Status Of Multiple Monitors Against Pool Member

Open Redirection Mitigation

F5Access | MacOS Sonoma

enable tls1.2 on management interface on F5 ltm running version 10.x

[ASM] - what is "Browser Challenge file" ?

Related Content

TCP Nagle Algorithm

Intro to Load Balancing for Developers – The Algorithms

A New and Better Nagle Algorithm

Implementing The Exponential Backoff Algorithm To Thwart Dictionary Attacks

Lightboard Lessons: Local Traffic Manager Load Balancing Algorithms