LINUX随笔十 SFTP不支持 ssh-dss,ssh-rsa

问题描述
[root@k8s01]# sftp -P 20001 [email protected]
Unable to negotiate with 192.168.10.128 port 20001: no matching host key type found. Their offer: ssh-dss,ssh-rsa
Connection closed.
Connection closed

根本原因之所以报错是因为OpenSSH7.0以后的版本不再支持ssh-dss(DSA)算法,官方的说法是这个算法太弱了。MACOS升到10.12附带的openssh
版本是7.4,如下:➜~sshd-Vsshd:illegaloption–VOpenSSH_7

解决方案：
命令行里添加选项
ssh -oHostKeyAlgorithms=+ssh-dss
添加 HostKeyAlgorithms +ssh-dss到配置 ~/.ssh/config

###sftp添加这个参数
[root@k8s01]# sftp -P 20001 -oHostKeyAlgorithms=+ssh-dss [email protected]
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that a host key has just been changed.
Please contact your system administrator.
Add correct host key in /root/.ssh/known_hosts to get rid of this message.
Offending RSA key in /root/.ssh/known_hosts:40
Host key for [192.168.10.128]:20001 has changed and you have requested strict checking.
Host key verification failed.

###删除某个文件
[root@k8s01]# rm /root/.ssh/known_hosts
rm: remove regular file ‘/root/.ssh/known_hosts’? y

[root@k8s01]# sftp -P 20001 -oHostKeyAlgorithms=+ssh-dss [email protected]
The authenticity of host ‘[192.168.10.128]:20001 ([192.168.10.128]:20001)’ can’t be established.
This key is not known by any other names
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added ‘[192.168.10.128]:20001’ (DSA) to the list of known hosts.
[email protected]’s password:
Connected to 192.168.10.128.
sftp>

最终解决办法：

添加 HostKeyAlgorithms +ssh-dss到配置 ~/.ssh/config
再执行
sftp -P 20001 [email protected] ##就可以了，可以脚本运行了