Why does the Talend Studio 7.2 or 7.3 SSH connection to github.com fails with the error "You're using an RSA key with SHA-1, which is no longer allowed"?

TalendSolutionExpert · Feb 9, 2024 1:22:49 PM

Problem

We assume that the Git project has been properly defined in TMC or TAC. The same issue occurs for Talend Studio connecting to TAC or TMC. In this document we will use a Studio connecting TMC. This issue only occurs with Talend Studio versions 7.2.1 and 7.3.1 (Talend Studio 8 is not impacted).

When trying to launch Talend Studio to initiate a SSH connection to github.com with RSA key, after selecting the project:

The following error is displayed:

The relevant error is:

ERROR: You're using an RSA key with SHA-1, which is no longer allowed. Please use a newer client or a different key type.
Please see https://github.blog/2021-09-01-improving-git-protocol-security-github/ for more information.

And this extract from the page referenced in the error message summarize the change applied by Github:

March 15, 2022

Changes made permanent.

We’ll permanently stop accepting DSA keys. RSA keys uploaded after the cut-off point above will work only with SHA-2 signatures (but again, RSA keys uploaded before this date will continue to work with SHA-1). The deprecated MACs, ciphers, and unencrypted Git protocol will be permanently disabled.

Solution

As currently Talend Studio 7.2.1 or 7.3.1 is only able to manage RSA keys with SHA-1 signature, the alternatives to work around this issue are:

Option 1: Use a real SSH client installed on the host for the SSH connection instead of the SSH client API included in Studio: The SSH client will be able to handle SSH connection with Github.com using RSA with others signatures like rsa-sha2-512 and rsa-sha2-256 that are accepted by Github.
Option 2: Use other keys format like ECDSA instead of RSA accepted by Github
Option 3: Enable Apache MINA sshd library in Studio and use ED25519 keys

Option 1: Using local SSH client

You just have to set in the environment variable GIT_SSH the path of the SSH client. For instance for Windows OS, if using the Microsoft SSH client:

C:\Windows\System32\OpenSSH\SSH.EXE

Assuming that the RSA key was properly created, and the SSH config file properly defined for github.com connection, the next step is to launch Talend Studio that will use the local SSH client for the SSH connection to Github.

Option 2: Using ECDSA keys

we must use ECDSA keys format for SSH connection with github.com following the steps below:

Generate the keys with ssh-keygen using the command below:

ssh-keygen -t ecdsa -b 256 -m PEM

Make sure to use the option -m PEM to generate the private key in the old PEM format that is supported by the SSH library used by Studio.
Open the private key (eg id_ecdsa) with an editor and verify that it starts with:

-----BEGIN EC PRIVATE KEY-----

Add the public key in the github.com keys list (In the User Settings, SSH and PGP keys)

In the .ssh folder, edit the config file and make sure it points to the correct private key as shown below:

Host github.com
 IdentityFile ~/.ssh/id_ecdsa

Launch Talend Studio and select the project and click Finish.

Studio is launched and connected to github.com

Option 3: Using Apache MINA sshd library ED25519 keys

By default Studio 7.2.1 and 7.3.1 uses the JSch SSH library for SSH connections to Git servers. But it's possible to switch to another SSH library (Apache MINA sshd) that offers the ability to use ED25519 keys. Here are the steps to apply for that:

Close Studio
Edit file at <studio workspace>/.metadata/.plugins/org.eclipse.core.runtime/.settings/org.eclipse.egit.core.prefs (if the file doesn't exist, just create it), add or update the following parameters:

core_ssh_client=apache
eclipse.preferences.version=1

Repeat the steps 1 to 3 from Option 2 procedure to generate the keys and import the public ED25519 key in github.com. The only difference will be the ssh-keygen command to use to generate the ED25519 keys: