Oracle-Linux 9 and Vagrant's insecure key (ssh-rsa)

[copyrights]

When using Vagrant 2.3.0 with oraclelinux/9 (virtualbox, 9.0.367) vagrant up fails with a timeout after

...
    default: SSH username: vagrant
    default: SSH auth method: private key
    default: Warning: Authentication failure. Retrying...
    default: Warning: Authentication failure. Retrying...
    default: Warning: Authentication failure. Retrying...
...

On server side /var/log/secure shows

Aug 27 21:30:17 localhost sshd[1739]: userauth_pubkey: key type ssh-rsa not in PubkeyAcceptedAlgorithms [preauth]
Aug 27 21:30:17 localhost sshd[1739]: Connection closed by authenticating user vagrant 10.0.2.2 port 35552 [preauth]

from OpenSSH_8.7p1, OpenSSL 3.0.1 14 Dec 2021

I would suggest this patch.

diff --git a/oracle-linux-image-tools/cloud/vagrant-virtualbox/files/vagrant-common.sh b/oracle-linux-image-tools/cloud/vagrant-virtualbox/files/vagrant-common.sh
index 9d4312c..dd2562e 100755
--- a/oracle-linux-image-tools/cloud/vagrant-virtualbox/files/vagrant-common.sh
+++ b/oracle-linux-image-tools/cloud/vagrant-virtualbox/files/vagrant-common.sh
@@ -44,6 +44,11 @@ vagrant::config()
                EOF
   fi
 
+  # set crypto-policies to legacy, because vagrant's insecure key is of type ssh-rsa
+  if [[ "${ORACLE_RELEASE}" = "9" ]]; then
+    /bin/update-crypto-policies --set LEGACY
+  fi
+
   cat >>/etc/sysconfig/sshd <<EOF
 
 # Decrease connection time by preventing reverse DNS lookups

[AmedeeBulle]

Thanks for reporting this.

This is somewhat interesting, because I can't reproduce on OL7 or OL8 hosts (which is why the test suite passed as we build on OL...)

On macOS, I do see this issue during vagrant up, but I can connect with vagrant ssh, which make me think that this has nothing to do with vagrant's insecure key but rather with the built-in ruby ssh library; probably due to hashicorp/vagrant#12344 or similar.

Based on that and as far as I can see, simply re-enabling SHA1 with the DEFAULT policy seems to do the trick

update-crypto-policies --set DEFAULT:SHA1

I would prefer to keep the DEFAULT policy rather than downgrading to LEGACY...

I'll make that change and re-publish the OL9 boxes.

[AmedeeBulle]

New boxes will be available when oracle/vagrant-projects#450 is merged