Skip to content

Aruba platform integration doesn't work after upgrade ssh-rsa algorithm is deprecated #120492

@quackelduck

Description

@quackelduck

The problem

I updated my Aruba 305 IAP to major version 8.12. They worked well before regarding the presence detection but I had some minor issues with some other wifi devices so decided to update.

As I found out after research, in Version 8.12 (or maybe even on earlier versions), Aruba has removed the ability to use ssh-rsa as HostKeyAlgorithms as this as deemed insecure and thus Aruba eliminated the ability to connect via ssh-rsa. This means that HA can't connect to Aruba Instant devices any more and returns an unexpected response.

When trying to connect via Terminal/SSH manually:

"ssh {user}@192.168.0.xxx, -o HostKeyAlgotiythms=ssh-rsa"
the response is
"Unable to negotiate with 192.168.0.xxx port 22: no matching host key type found. Their offer: rsa-sha2-512,rsa-sha2-256,ecdsa-sha2-nistp256,ssh-ed25519"

-> When I simply change the HostKeyAlgorithm in the above query to rsa-sha2-512 it returns the fingerprint, asks for password and I can request the client list.

Firmware of Aruba IAPs is "8.12.0.1_89864 SSR (Digitally Signed - Production Build)"

What version of Home Assistant Core has the issue?

core-2024.6.4, also core-2024.7.0

What was the last working version of Home Assistant Core?

This is not a HA problem but rather HA is using an outdated encryption.

What type of installation are you running?

Home Assistant OS

Integration causing the issue

Aruba

Link to integration documentation on our website

https://www.home-assistant.io/integrations/aruba/

Diagnostics information

Line 92 in the device_tracker.py is not working for me any more due to the update by Aruba. The HostKeyAlgorithms=ssha-rsa is not supported any more and this code should be changed to HostKeyAlgorithms=rsa-sha2-512 and then tested.

Example YAML snippet

No response

Anything in the logs that might be useful for us?

No response

Additional information

No response

### Tasks
- [ ] change line 92 in the code to use a different encryption algorithm.
- [ ] Test for compatibility

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions