21 October 2020

AWS Lightsail ssh web trouble - ubuntu

After upgrading Ubuntu 18.04 LTS to 20.04 LTS ssh via web is broken.

ssh via putty still worked.

I have found the solution here:

https://help.okta.com/en/prod/Content/Topics/Adv_Server_Access/docs/sftd-ubuntu.htm

For servers running Ubuntu 20.04, you have to allow certificate authorities (CAs) to use the ssh-rsa algorithm to sign certificates. To do this, add the following line to your OpenSSH daemon file (which is either /etc/ssh/sshd_config or a drop-in file under /etc/ssh/sshd_config.d/)

To fix it, add following 2 lines to /etc/ssh/sshd_config

TrustedUserCAKeys /etc/ssh/xxxxxxx 
CASignatureAlgorithms +ssh-rsa

Replace xxxxxxx by the public key you can find in /etc/ssh

The public key file is probably called lightsail_instance_ca.pub

Restart sshd service after changing the sshd_config file:

sudo service sshd stop
sudo service sshd start

OR

sudo service sshd restart

Tip: To find the non-comment lines in sshd_config:

grep '^[[:blank:]]*[^[:blank:]#;]' /etc/ssh/sshd_config

Include /etc/ssh/sshd_config.d/*.conf
PasswordAuthentication no
ChallengeResponseAuthentication no
UsePAM yes
X11Forwarding yes
PrintMotd no
TCPKeepAlive yes
ClientAliveInterval 30
AcceptEnv LANG LC_*
Subsystemsftp/usr/lib/openssh/sftp-server
TrustedUserCAKeys /etc/ssh/xxxxxxx
CASignatureAlgorithms +ssh-rsa

No comments: