I am currently running Veeam Backup & Replication (VBR) version 12.3.0 and encountering the error "Permission denied (public key)" when trying to add a component server running Ubuntu 22 using SSH keys.
Upon reviewing the logs on the Ubuntu 22 component server, I repeatedly see the following error:
"Unable to negotiate with 10.0.0.8 port 64513: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth]."
It appears the VBR backuo server is offering outdated or non-compliant algorithms, such as diffie-hellman-group1-sha1, hmac-sha1, and also requires the deprecated ssh-rsa for public key authentication.
As a result, my SSH connection from the backup server (10.0.0.8) to the component server fails, and I see the "Permission denied (public key)" error in the VBR console.
I prefer to use SSH keys for authentication, and the SSH configuration (sshd_config) on the component server includes the following settings:
GSSAPI Key Exchange Algorithms: gss-group14-sha256-,gss-group16-sha512-,gss-nistp256-sha256-,gss-curve25519-sha256-,gss-group14-sha1-,gss-gex-sha1-
Ciphers: aes128-ctr,aes192-ctr,aes256-ctr
MACs: hmac-sha2-256,hmac-sha2-512
Key Exchange Algorithms: ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256
It seems that the backup server is still accepting outdated key exchange methods and algorithms (diffie-hellman-group1-sha1, hmac-sha1), which are not compliant with current security standards. Could the VBR backup server configuration be adjusted to disable these deprecated algorithms and ensure compatibility with modern, secure methods for SSH key-based authentication?
