News for hackers. Stuff that matters.

A comment on Timeline to remove DSA support in OpenSSH. Parent comment

Re:Timeline to remove DSA support in OpenSSH by roblabla on Thursday January 11, 2024 @09:46AM (#38952830)
It's been disabled by default since 2015 - you need to enable support for them in the config file, otherwise the client will error out. In other words, if you don't have the following line in your ~/.ssh/config, you're fine:

PubkeyAcceptedKeyTypes=+ssh-dss

[ Parent | on HN ]
Re:Timeline to remove DSA support in OpenSSH by Arnt on Thursday January 11, 2024 @12:55PM (#38955905)
That's great. Do you know what happens when an old unattended client with an old old key connects to a new server?
[ Parent | on HN ]
Re:Timeline to remove DSA support in OpenSSH by Symbiote on Thursday January 11, 2024 @03:24PM (#38958459)
The same as happened last year, and will happen next year, since your old client isn't being updated.
[ Parent | on HN ]
Re:Timeline to remove DSA support in OpenSSH by Arnt on Friday January 12, 2024 @03:07AM (#38965401)
So it's only being ditched from the clients, not the servers? I'm happy to hear that.
[ Parent | on HN ]
Re:Timeline to remove DSA support in OpenSSH by Symbiote on Friday January 12, 2024 @06:09AM (#38966649)
Assuming you haven't edited it, I misread your comment and my reply is probably incorrect.

You presumably have a configuration option allowing the old encryption in your server configuration, which is your warning that you're running a legacy system.

[ Parent | on HN ]