Users who are using Fedora 33 or later with the the DEFAULT or FUTURE crypto settings are unable to use Git over SSH on Gerrit:
$ git clone ssh://xxmarijnw@gerrit.wikimedia.org:29418/mediawiki/extensions/AbuseFilter.git Cloning into 'AbuseFilter'... Bad server host key: Invalid key length fatal: Could not read from remote repository. Please make sure you have the correct access rights and the repository exists.
Gerrit seems to be using an old 1024-bit RSA key:
$ ssh -o VisualHostKey=yes ssh://xxmarijnw@gerrit.wikimedia.org:29418 RSA key fingerprint is SHA256:j7HQoQ6fIuEgDHjONjI2CZ+2Iwxqgo2Ur5LbPqBgxOU. +---[RSA 1024]----+ | | |. . | |= + . | |+BoE o . | |BBX . o S | |@@o+ + o = | |X=*.. + o . | |*ooo . | |o+o. | +----[SHA256]-----+
This key is not compatible with the DEFAULT or FUTURE crypto settings included with Fedora 33, which mandate an RSA key length of 2048 and 3072 respectively (see https://fedoraproject.org/wiki/Changes/StrongCryptoSettings2).
Workarounds
Affected users can decrease the minimum key length requirement for gerrit.wikimedia.org specifically in their ~/.ssh/config file:
Host gerrit.wikimedia.org
RSAMinSize 1023another work around is to switch to the LEGACY crypto settings, for all the OS:
$ sudo update-crypto-policies --set LEGACYThis task is tangentally related to T276486.