CentOS Stream 9 – Common Problem 047 – Diagnosis and Fix

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Key-based SSH login refused on CentOS Stream 9 host after upgrade.

Environment & Reproduction

Hosts using legacy RSA SHA-1 keys.

cat /etc/os-release
uname -r
rpm -qa | grep 

Root Cause Analysis

sshd default disabled ssh-rsa with SHA-1 algorithms.

Quick Triage

Confirm package, network, SELinux and firewall state.

sshd -T | grep -i algo
ls -l ~/.ssh/authorized_keys
ssh -vvv host 2>&1 | tail -n 40

Step-by-Step Diagnosis

Drill into ssh/keys state and recent journal entries to isolate the failure.

journalctl -u sshd -n 80
ssh -G host | grep -i alg

Solution – Primary Fix

Apply the standard remediation for ssh/keys on CentOS Stream 9.

ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519
ssh-copy-id user@host
sudo systemctl restart sshd

Solution – Alternative Approaches

Temporarily set PubkeyAcceptedAlgorithms +ssh-rsa during migration.

Verification & Acceptance Criteria

Validate the fix with positive functional checks before closing.

ssh -i ~/.ssh/id_ed25519 user@host

Rollback Plan

Revert to the previous known-good configuration if the fix regresses.

Restore sshd_config from /root/backup and restart sshd.

Prevention & Hardening

Codify the fix in configuration management and add monitoring.

Rotate keys to ed25519 in configuration management.

Related Errors & Cross-Refs

Host key change warnings and known_hosts issues.

Related tutorial: View the step-by-step tutorial for centos-stream-9.

View all centos-stream-9 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

OpenSSH release notes.