This is actually a really useful find. A lot of people would probably assume the problem is with 1Password or their SSH config, when it’s really the old Dropbear implementation on the device side. Older Dropbear versions on things like UniFi APs, https://speedport-ips.de/, and OpenWRT devices can be surprisingly limiting with modern SSH tooling. The key detail here is that those older builds only support ssh-rsa, while newer agents/tools try to use newer RSA SHA2 algorithms or Ed25519 keys by default. The agent refused operation error is especially misleading because it sounds like the agent itself is broken. Upgrading firmware is probably the best fix if possible. Otherwise people end up wasting hours tweaking SSH configs when the real issue is just the device running a very old Dropbear release.

@compunction Yes, sorry for the confusion, but all I meant to say that if we now add ssh-rsa support to the agent, you would be free to opt out of that using that snippet I posted. But yes, if the server only supports ssh-rsa, then it is expected that opting out results in a broken auth flow.

floris_1P If I do that in my client config I get:

debug1: Offering public key: removed RSA SHA256:+Q4xSw+GPZrn+v3tMjfTrOqw2Zsiy+ChL/YajpdFmuc agent
debug1: send_pubkey_test: no mutual signature algorithm
debug1: Offering public key: removed RSA SHA256:IIP+sCXT7oTh4Ua8AobOPCNoJklDC55UfmHvtyPYSeM agent
debug1: send_pubkey_test: no mutual signature algorithm

If I reconfigure the SSHD, I would expect it to get broken on the next firmware update.

@compunction You can already opt out of ssh-rsa through your SSH config:


HostkeyAlgorithms -ssh-rsa
PubkeyAcceptedAlgorithms -ssh-rsa


floris_1P I like the idea of dropping insecure protocols and if at some day unifi updates SSHD I would prefer not to have what I assume is a potential Man in the middle vector (of course I only ssh into these devices on network, so lower risk). Maybe a configuration checkbox for legacy protocols on the developer config menu? If it could be done by key that would be even better so I could enable just for the key I use for Unifi. Just thinking not sure what is possible ;-)

Correct. We currently don't support ssh-rsa / SHA-1 signatures, but because of the compatibility issues this imposes, we're working on adding support for it anyway.

I found this error in the logs:
ERROR 2022-03-24T15:24:37.782 tokio-runtime-worker(ThreadId(3)) [1P:/Users/builder/builds/BhfSvM9x/0/dev/core/core/ssh/op-ssh-agent/src/lib.rs:377] Error handling sign request: Key(signing with ssh-rsa is unsupported; SHA-1 may be insecure)
ERROR 2022-03-24T15:24:37.798 tokio-runtime-worker(ThreadId(7)) [1P:/Users/builder/builds/BhfSvM9x/0/dev/core/core/ssh/op-ssh-agent/src/lib.rs:377] Error handling sign request: Key(signing with ssh-rsa is unsupported; SHA-1 may be insecure)

But when I tried to add these to my config file it got an error:
Host old-host
HostkeyAlgorithms +ssh-rsa
PubkeyAcceptedAlgorithms +ssh-rsa

That and this seems like the op-ssh-agent does not support the legacy key signing.

I have a similar issue, but with openssh on UniFi Cloud Key

Server: OpenSSH_7.4p1 Debian-10+deb9u7, OpenSSL 1.0.2u 20 Dec 2019
Error: sign_and_send_pubkey: signing failed for RSA "" from agent: agent refused operation

Working linux box is Server: OpenSSH_8.4p1 Ubuntu-6ubuntu2.1, OpenSSL 1.1.1l 24 Aug 2021

Client is: OpenSSH_8.6p1, LibreSSL 3.3.5

Key works fine if I do a -i in and unset SSH_AUTH_SOCK

I have the same issue with a few Mikrotik routers, even on their latest RouterOS 7.x. I use the ssh client in WSL (Windows subsystem for Linux) and as a workaround i unset SSH_AUTH_SOCK and load the key from the filesystem using the -i to ssh.

OpenSSH 8.8 has also disabled sha-rsa by default, so anyone running that client would also have difficulty using ssh keys with these old ssh servers.

https://www.openssh.com/txt/release-8.8

However, they do apparently provide a way to explicitly re-enable it for old hosts according to those release notes.


Host old-host
HostkeyAlgorithms +ssh-rsa
PubkeyAcceptedAlgorithms +ssh-rsa


This doesn't work with the 1Password ssh-agent.