4 ms·

Last I checked, Azure didn't support Ed25519 keys, so manual fallback to RSA will now be required. https://feedback.azure.com/d365community/idea/1dca6716-dc25-

by jshier 3y ago

Last I checked, Azure didn't support Ed25519 keys, so manual fallback to RSA will now be required. https://feedback.azure.com/d365community/idea/1dca6716-dc25-ec11-b6e6-000d3a4f06a4 https://feedback.azure.com/d365community/idea/1dca6716-dc25-...

milliams 3y ago
That seems like specifically Azure DevOps, not the Azure platform generally? I assume any OS running inside Azure Compute, or any other managed services will support Ed25519 fine?
- Arnavion 3y ago
  The API for creating Azure VMs doesn't support specifying an ED25519 key. https://docs.microsoft.com/en-us/azure/virtual-machines/linux/mac-create-ssh-keys#supported-ssh-key-formats https://docs.microsoft.com/en-us/azure/virtual-machines/linu... But once you've created the VM you can log in and replace that RSA key with an ED25519 one just like any standard Linux install, via ssh-copy-id or manually updating authorized_keys or whatever you want. So you just need a throwaway RSA key for the initial deployment.
  - milliams 3y ago
    Thanks for the information. That's pretty embarrassing that it's still not supported.
  - pritambaral 3y ago
    If Azure supports cloud-init, you can forego that throwaway RSA key.
akulbe 3y ago
That wouldn’t surprise me at all. I recently had issues with an EC2 instance in AWS that I couldn’t auth to, with an Ed25519-based key. Turns out they didn’t even support it until ~2021. These instances were created before then. It took quite a while to figure out what was going on.
- pritambaral 3y ago
  Does Azure not support cloud-init? When AWS complained about Ed25519 keys, I just told AWS to not associate any keys at all and just put my key in the cloud-init config. The OS copies the contents from cloud-init to the appropriate authorized_keys file on first boot and it's none of AWS's business which key (or how many keys) I use to login into my instances.
prussian 3y ago
It's probably because FIPS 140-2 doesn't list it. I know machines booted with fips=1 and fips certified openssl, etc, openssh won't accept ed25519 keys for key auth.

by jshier 3y ago

milliams 3y ago

That seems like specifically Azure DevOps, not the Azure platform generally? I assume any OS running inside Azure Compute, or any other managed services will support Ed25519 fine?

Arnavion 3y ago
The API for creating Azure VMs doesn't support specifying an ED25519 key. https://docs.microsoft.com/en-us/azure/virtual-machines/linux/mac-create-ssh-keys#supported-ssh-key-formats https://docs.microsoft.com/en-us/azure/virtual-machines/linu... But once you've created the VM you can log in and replace that RSA key with an ED25519 one just like any standard Linux install, via ssh-copy-id or manually updating authorized_keys or whatever you want. So you just need a throwaway RSA key for the initial deployment.
- milliams 3y ago
  Thanks for the information. That's pretty embarrassing that it's still not supported.
- pritambaral 3y ago
  If Azure supports cloud-init, you can forego that throwaway RSA key.

akulbe 3y ago

That wouldn’t surprise me at all. I recently had issues with an EC2 instance in AWS that I couldn’t auth to, with an Ed25519-based key. Turns out they didn’t even support it until ~2021. These instances were created before then. It took quite a while to figure out what was going on.

pritambaral 3y ago
Does Azure not support cloud-init? When AWS complained about Ed25519 keys, I just told AWS to not associate any keys at all and just put my key in the cloud-init config. The OS copies the contents from cloud-init to the appropriate authorized_keys file on first boot and it's none of AWS's business which key (or how many keys) I use to login into my instances.

prussian 3y ago

It's probably because FIPS 140-2 doesn't list it. I know machines booted with fips=1 and fips certified openssl, etc, openssh won't accept ed25519 keys for key auth.