Re:Timeline to remove DSA support in OpenSSH
by Arnt on Thursday January 11, 2024 @09:39AM
(#38952736)
I don't want to be nervous about whether I need it, I'd prefer an alert when it's used, turned on by default for a year.
[ Parent
| on HN ]
Re:Timeline to remove DSA support in OpenSSH
by roblabla on Thursday January 11, 2024 @09:46AM
(#38952830)
It's been disabled by default since 2015 - you need to enable support for them in the config file, otherwise the client will error out. In other words, if you don't have the following line in your ~/.ssh/config, you're fine:
PubkeyAcceptedKeyTypes=+ssh-dss
Re:Timeline to remove DSA support in OpenSSH
by Arnt on Thursday January 11, 2024 @12:55PM
(#38955905)
That's great. Do you know what happens when an old unattended client with an old old key connects to a new server?
Re:Timeline to remove DSA support in OpenSSH
by Symbiote on Thursday January 11, 2024 @03:24PM
(#38958459)
The same as happened last year, and will happen next year, since your old client isn't being updated.
Re:Timeline to remove DSA support in OpenSSH
by Arnt on Friday January 12, 2024 @03:07AM
(#38965401)
So it's only being ditched from the clients, not the servers? I'm happy to hear that.
Re:Timeline to remove DSA support in OpenSSH
by Symbiote on Friday January 12, 2024 @06:09AM
(#38966649)
Assuming you haven't edited it, I misread your comment and my reply is probably incorrect.
You presumably have a configuration option allowing the old encryption in your server configuration, which is your warning that you're running a legacy system.