ssh key creation steps for icx6xxx from Linux | Fix for ssh_dispatch_run_fatal: error in libcrypto / invalid format

[RustyPedrosa]

I hit a few hitches trying to set up ssh for my icx6430-c12, and thought I would drop some notes here in case it saves other people some time (if anyone is even using these anymore). I'm running Nobara Linux 43 (based on Fedora 43).

While following the steps here:
https://fohdeesha.com/docs/icx6xxx-adv.html#optional-key-based-ssh-access

After uploading my ssh key and trying to connect (hostname iris), I got stuck at:

$ ssh iris
ssh_dispatch_run_fatal: Connection to 10.0.0.5 port 22: error in libcrypto

This was fixed by:

$ echo '__openssl_block_sha1_signatures = 0' | sudo tee /etc/crypto-policies/policies/modules/SHA1-SSL-SIG.pmod > /dev/null
$ sudo update-crypto-policies --set DEFAULT:SHA1-SSL-SIG

Source: https://discussion.fedoraproject.org/t/fedora-41-ssh-to-rhel6-error-in-libcrypto/135999/12

However, that led to a new error:

$ ssh iris
ssh_dispatch_run_fatal: Connection to 10.0.0.5 port 22: invalid format

I wound up having to explicitly specify 2048-bit key size (it was defaulting to 3072), and converting the public key to RFC4716 via ssh-keygen -e -m instead of adding the BEGIN and END lines manually

I created the key with
ssh-keygen -t rsa -b 2048 -f ~/.ssh/id_rsa_iris_2048

then converted the key via
ssh-keygen -e -m RFC4716 -f ~/.ssh/id_rsa_iris_2048.pub > ~/.ssh/id_rsa_iris_2048_ssh2.pub

and sent that over to the switch via tftp.

I will also note that ChatGPT suggested I change PubKeyAccepterKeyTypes to PubkeyAcceptedAlgorithms, so my ~.ssh/config looks like this

Host iris
   HostName 10.0.0.5
   IdentitiesOnly yes
   IdentityFile ~/.ssh/id_rsa_iris_2048
   KexAlgorithms +diffie-hellman-group1-sha1
   PubkeyAcceptedAlgorithms=+ssh-rsa
   HostKeyAlgorithms=+ssh-rsa

Problem solved - passwordless ssh achieved.

$ ssh iris
SSH@iris>