Skip to content

disabled Ssh algorithms#218

Merged
thorinaboenke merged 3 commits intoait-testbed:developmentfrom
thorinaboenke:ssh_algorithms
Apr 9, 2026
Merged

disabled Ssh algorithms#218
thorinaboenke merged 3 commits intoait-testbed:developmentfrom
thorinaboenke:ssh_algorithms

Conversation

@thorinaboenke
Copy link
Copy Markdown
Contributor

Problem

Connecting to legacy SSH servers (for example e.g. OpenSSH 4.7 on Metasploitable2, important for training puposes) with
key-based auth fails because paramiko negotiates rsa-sha2-256/rsa-sha2-512 by default, which old servers don't support.

Changes

  • schemas/ssh.py: added disabled_algorithms: Optional[Dict[str, List[str]]] = None
  • executors/ssh/sshexecutor.py: initialized self.disabled_algorithms = None in set_defaults(), cache it in cache_settings(), and pass it to connect() calls
  • updated docs

Usage

  - type: ssh
    hostname: $TARGET
    username: root
    key_filename: /tmp/backdoor_key
    disabled_algorithms:
      pubkeys:
        - rsa-sha2-256
        - rsa-sha2-512     

@thorinaboenke thorinaboenke merged commit 90fd5e0 into ait-testbed:development Apr 9, 2026
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant