OpenSSH升级到OpenSSH_8.8p1，秘钥登录异常解决

[sysadmin@VM_2_14_centos log]$ sudo systemctl status sshd
● sshd.service - SYSV: OpenSSH server daemon
   Loaded: loaded (/etc/rc.d/init.d/sshd; bad; vendor preset: enabled)
   Active: active (running) since Fri 2022-09-16 10:58:27 CST; 23min ago
     Docs: man:systemd-sysv-generator(8)
  Process: 12145 ExecStop=/etc/rc.d/init.d/sshd stop (code=exited, status=0/SUCCESS)
  Process: 8343 ExecReload=/etc/rc.d/init.d/sshd reload (code=exited, status=0/SUCCESS)
  Process: 12154 ExecStart=/etc/rc.d/init.d/sshd start (code=exited, status=0/SUCCESS)
 Main PID: 12162 (sshd)
   CGroup: /system.slice/sshd.service
           └─12162 sshd: /usr/sbin/sshd [listener] 0 of 10-100 startups

Sep 16 10:58:27 VM_2_14_centos sshd[12154]: [  OK  ]
Sep 16 10:58:27 VM_2_14_centos systemd[1]: Started SYSV: OpenSSH server daemon.
Sep 16 10:58:58 VM_2_14_centos sshd[12239]: rexec line 125: Deprecated option UsePrivilegeSeparation
Sep 16 10:58:58 VM_2_14_centos sshd[12239]: userauth_pubkey: key type ssh-rsa not in PubkeyAcceptedAlgorithms [preauth]
Sep 16 10:59:00 VM_2_14_centos sshd[12239]: error: Received disconnect from 10.3.20.5 port 2194:0:  [preauth]
Sep 16 10:59:00 VM_2_14_centos sshd[12239]: Disconnected from authenticating user sysadmin 10.3.20.5 port 2194 [preauth]Sep 16 11:11:29 VM_2_14_centos sshd[14252]: rexec line 125: Deprecated option UsePrivilegeSeparation
Sep 16 11:11:29 VM_2_14_centos sshd[14252]: Accepted password for sysadmin from 10.98.201.10 port 57772 ssh2
Sep 16 11:20:31 VM_2_14_centos sshd[15725]: rexec line 125: Deprecated option UsePrivilegeSeparation
Sep 16 11:20:31 VM_2_14_centos sshd[15725]: Accepted password for sysadmin from 10.98.201.10 port 58686 ssh2

看主要信息
userauth_pubkey: key type ssh-rsa not in PubkeyAcceptedAlgorithms [preauth]

解决办法:
在/etc/ssh/sshd_config里面新增如下配置项
PubkeyAcceptedKeyTypes=+ssh-rsa
官方解释：

Starting with the 7.0 release of OpenSSH, support for ssh-dss keys has
been disabled by default at runtime due to their inherit weakness. If
you rely on these key types, you will have to take corrective action or
risk being locked out.

Your best option is to generate new keys using strong algos such as rsa
or ecdsa or ed25519. RSA keys will give you the greatest portability
with other clients/servers while ed25519 will get you the best security
with OpenSSH (but requires recent versions of client & server).

If you are stuck with DSA keys, you can re-enable support locally by
updating your sshd_config and ~/.ssh/config files with lines like so:
PubkeyAcceptedKeyTypes=+ssh-dss

Be aware though that eventually OpenSSH will drop support for DSA keys
entirely, so this is only a stop gap solution.

More details can be found on OpenSSH’s website:
http://www.openssh.com/legacy.html
原文链接：https://blog.csdn.net/shengshuai/article/details/84285404

翻译：

从 OpenSSH 7.0 版本开始，由于 ssh-dss 密钥的继承弱点，默认情况下在运行时禁用了对它们的支持。 如果您依赖这些密钥类型，您将不得不采取纠正措施，否则将面临被锁定的风险。

您最好的选择是使用强算法（如 rsa 或 ecdsa 或 ed25519）生成新密钥。 RSA 密钥将为您提供与其他客户端/服务器的最大可移植性，而 ed25519 将为您提供 OpenSSH 的最佳安全性（但需要最新版本的客户端和服务器）。

如果您无法使用 DSA 密钥，您可以通过以下方式在本地重新启用支持
使用如下行更新您的 sshd_config 和 ~/.ssh/config 文件：
PubkeyAcceptedKeyTypes=+ssh-dss

请注意，尽管最终 OpenSSH 将完全放弃对 DSA 密钥的支持，因此这只是权宜之计。

更多细节可以在 OpenSSH 的网站上找到：
http://www.openssh.com/legacy.html