userauth_pubkey: signature algorithm ssh-rsa not in PubkeyAcceptedAlgorithms [preauth]

Wording by sshd release (checked in the OpenSSH sources): 9.0 and later "signature algorithm … not in PubkeyAcceptedAlgorithms"; 8.5–8.9 "key type … not in PubkeyAcceptedAlgorithms"; 8.4 and earlier "key type … not in PubkeyAcceptedKeyTypes" (the option was renamed in 8.5). The algorithm in the message varies with the client and the server's restriction.

OpenSSH server (sshd) log — the client sees only "Permission denied (publickey)."

What it means

The server's log explains a "Permission denied (publickey)": the client presented a signature algorithm the server does not accept. With `ssh-rsa` this is the SHA-1 based RSA signature scheme, disabled by default since OpenSSH 8.8 (2021). The RSA key itself is fine — the same key works with the `rsa-sha2-256`/`rsa-sha2-512` algorithms — but the client (an old OpenSSH, an outdated library or an embedded device) only knows the SHA-1 variant.

Why it happens

• An old SSH client or library signs with ssh-rsa

  common

  OpenSSH before 7.2, Paramiko before 2.9 (also behind Ansible's paramiko connection plugin), the original JSch 0.1.55 (Jenkins plugins, IDEs), older golang.org/x/crypto and many network devices only produce `ssh-rsa` signatures.

• The server restricts algorithms further

  occasional

  Hardening guides set `PubkeyAcceptedAlgorithms` to a short list (for example Ed25519 and ECDSA only); RSA or Ed25519 keys outside that list are refused, as the alias with `ssh-ed25519` shows.

• A DSA key

  occasional

  `ssh-dss` has been disabled since OpenSSH 7.0 and removed in 10.0. DSA keys must be replaced.

How to fix it

1. 1.

   Use a modern key or a modern client

   An Ed25519 key avoids the RSA/SHA-1 problem completely; otherwise update the client library so it negotiates `rsa-sha2-*`.

   # Best: a modern key type, which every current client signs correctly
   ssh-keygen -t ed25519 -C "deploy@ci" -f ~/.ssh/deploy_ed25519
   # Or keep the RSA key and use a client that supports rsa-sha2-256/512
   # (OpenSSH >= 7.2, Paramiko >= 2.9, JSch fork 0.2.x, golang.org/x/crypto >= 2022, PuTTY >= 0.75)

2. 2.

   Allow ssh-rsa narrowly, if you must

   A `Match` block for one legacy device keeps SHA-1 signatures away from everyone else. Treat it as temporary.

   # /etc/ssh/sshd_config.d/legacy-device.conf - only for one legacy client, and remove it afterwards
   Match Address 10.0.5.17
       PubkeyAcceptedAlgorithms +ssh-rsa

← Browse the full signature error database