Comment 3 for bug 2028867

Revision history for this message
John A Meinel (jameinel) wrote :

My best guess is that your host's OpenSSH supports "pubkeyacceptedalgorithms" in its .ssh/config, but the one that juju ships inside the confined snap does not.

To verify this, you could try to do:
ssh ubuntu@10.18.61.55

And see whether the host's ssh is happy, but then do:
snap run --shell juju
$$ type -a ssh
ssh is /snap/juju/23846/usr/bin/ssh
...
$$ ssh ubuntu@10.18.61.55

And see whether the confined ssh is unhappy with that ssh configuration.

Certainly the expectation is that we cannot do much about
   ControlPath ~/.ssh/%r@%h

Because it is very likely that snap confinement means that processes running inside the confined Juju snap cannot access the custom directories that are supplied by your ssh config.

I was able to reproduce that on my jammy machine:
$ cat ~/.ssh/config

Host 10.25.164.32
        PubkeyAcceptedAlgorithms +ssh-rsa

$ juju ssh controller/0
/home/jameinel/.ssh/config: line 3: Bad configuration option: pubkeyacceptedalgorithms
/home/jameinel/.ssh/config: terminating, 1 bad configuration options

$ ssh ubuntu@10.25.164.32
# is happy

$ ssh -V
OpenSSH_8.9p1 Ubuntu-3ubuntu0.3, OpenSSL 3.0.2 15 Mar 2022
$ snap run --shell juju
$$ ssh -V
OpenSSH_8.2p1 Ubuntu-4ubuntu0.8, OpenSSL 1.1.1f 31 Mar 2020

So Jammy is shipping ssh 8.9, but Juju is bundling 8.2. We should almost certainly update that.