Arch Linux

UrbenLegend

Member

Registered: 2021-03-26

Posts: 43

openssh 10.6p1-2 breaks SFTP in Dolphin

I upgraded my NAS from openssh 10.6p1-1 to 10.6p1-2, which added quantum-safe mldsa44-ed25519 keys via this commit to the openssh package, but ever since that update Dolphin has been complaining non-stop about host verification failures when attempting to connect to the NAS over SFTP. Clicking "Connect Anyway" sometimes connects, other times just adds duplicate entries into my known_hosts file, and sometimes even triggers a crash, cancelling any in-progress SFTP transfers.

Bug seems to be triggered when Dolphin attempts to connect to a known host that has a ssh-mldsa44-ed25519 entry in known_hosts. Deleting those entries for a specific host allows Dolphin to connect properly without continuously asking about host fingerprint. To prevent further new hosts from adding similar entries into your known_hosts, there's a few workarounds.

You can disable the mldsa44-ed25519 host key server side via a drop-in file at /etc/ssh/sshd_config.d/

HostKey /etc/ssh/ssh_host_ed25519_key
HostKey /etc/ssh/ssh_host_ecdsa_key
HostKey /etc/ssh/ssh_host_rsa_key

or you can add

Host *
    HostKeyAlgorithms -ssh-mldsa44-ed25519*

to the ~/.ssh/config on your client machine. Both ways will prevent new mldsa44-ed25519 keys from being added to known_hosts. Any pre-existing ones will not be removed and will still cause problems.

I am not sure whether this is a KIO SFTP issue that belongs with kio-extras or a libssh issue (which is what AI said it could possibly be, I have not verified at all). I've filed a bug with KDE here: https://bugs.kde.org/show_bug.cgi?id=527222

If anyone has a better workaround let me know. If its a libssh issue, perhaps these ML-DSA keys shouldn't be enabled by default in the openssh package yet?