Option to allow Warpgate to use rsa-sha/rsa-dss host keys

[budachst]

Now, that Warpgate allows insecure algos when connecting to old hosts, there's one more issue, when trying to access very old systems: these systems also most often cannot cope with Warpgate's own rsa2 host key, as shown in this example:

Nov 28 08:22:49 id-test sshd[6272]: userauth_pubkey: unsupported public key algorithm: ssh-ed25519
Nov 28 08:22:49 id-test sshd[6272]: userauth_pubkey: unsupported public key algorithm: rsa-sha2-256
Nov 28 08:22:49 id-test sshd[6272]: Received disconnect from XXX.XXX.XXX.XXX

It would be great to enable Warpgate to use rsa-sha/rsh-dss host keys when connecting to targets, which have been configured to allow insecure algos.

[codyro]

This opens up a foot gun for individuals who don't understand the implications of using the wrong or insecure key from WarpGate.

If the developer intends to add this, the UX needs to be very clear that these keys are only to be used in very specific instances (e.g., very legacy hardware).

I understand the need for this—I also have some problematic old network gear. It’s just a scary notion, as many end users don’t fully understand the risks of such things.

[budachst]

I understand your sentiment, but limiting the use of Warpgate for that reason is beyond me. In the end the risk is on the target side anyway - it's where you need to be cautious of what connections you allow or not. And you'd only switch to insecure algos if you'd need them right now as well, so that itself has to be a conscious decision.

[codyro]

I concur. I was concerned that how it's presented (or implemented) matters significantly in this case. For instance, if it automatically generated keys using insecure algos and presented them to the user on the same page as the RSA/ED25519 keys without an unambiguous warning, it asks for trouble (people mindlessly copy keys they have no business using).

[Eugeny]

For RSA key auth, the hash algorithm is not a part of key definition, so "ssh-rsa key" and "rsa-sha2-512 key" are just the same key, the only difference is in the signature algorithm.

[Eugeny]

This issue should have actually been fixed as it's essentially same as #983 - could you test the nightly please?

[budachst]

Will do and report back tomorrow.

[budachst]

I checked the latest nightly and the issue still persists:

Nov 29 08:21:11 id-test sshd[9538]: userauth_pubkey: unsupported public key algorithm: ssh-ed25519
Nov 29 08:21:11 id-test sshd[9538]: userauth_pubkey: unsupported public key algorithm: rsa-sha2-256
Nov 29 08:21:11 id-test sshd[9538]: Received disconnect from XXX.XXX.XXX.XXX: 11: