diff options
author | Colin Watson <cjwatson@debian.org> | 2017-01-16 13:53:04 +0000 |
---|---|---|
committer | Colin Watson <cjwatson@debian.org> | 2017-10-04 13:54:48 +0100 |
commit | 922f3a7599d03234b6bb2ffb22a33624e7cf1953 (patch) | |
tree | 02ddd5fff1b052ae44e3abe85a1eb2651ece4850 | |
parent | 4847e512c0b94c615b838904a5f139a761bee284 (diff) |
Remove ssh_host_dsa_key from HostKey default
The client no longer accepts DSA host keys, and servers using the
default HostKey setting should have better host keys available.
Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=2662
Bug-Debian: https://bugs.debian.org/850614
Last-Update: 2017-01-16
Patch-Name: no-dsa-host-key-by-default.patch
-rw-r--r-- | servconf.c | 2 | ||||
-rw-r--r-- | sshd.8 | 7 | ||||
-rw-r--r-- | sshd_config | 1 | ||||
-rw-r--r-- | sshd_config.5 | 7 |
4 files changed, 6 insertions, 11 deletions
diff --git a/servconf.c b/servconf.c index b01464059..5e996cf8f 100644 --- a/servconf.c +++ b/servconf.c | |||
@@ -205,8 +205,6 @@ fill_default_server_options(ServerOptions *options) | |||
205 | /* fill default hostkeys for protocols */ | 205 | /* fill default hostkeys for protocols */ |
206 | options->host_key_files[options->num_host_key_files++] = | 206 | options->host_key_files[options->num_host_key_files++] = |
207 | _PATH_HOST_RSA_KEY_FILE; | 207 | _PATH_HOST_RSA_KEY_FILE; |
208 | options->host_key_files[options->num_host_key_files++] = | ||
209 | _PATH_HOST_DSA_KEY_FILE; | ||
210 | #ifdef OPENSSL_HAS_ECC | 208 | #ifdef OPENSSL_HAS_ECC |
211 | options->host_key_files[options->num_host_key_files++] = | 209 | options->host_key_files[options->num_host_key_files++] = |
212 | _PATH_HOST_ECDSA_KEY_FILE; | 210 | _PATH_HOST_ECDSA_KEY_FILE; |
@@ -164,11 +164,10 @@ This option must be given if | |||
164 | is not run as root (as the normal | 164 | is not run as root (as the normal |
165 | host key files are normally not readable by anyone but root). | 165 | host key files are normally not readable by anyone but root). |
166 | The default is | 166 | The default is |
167 | .Pa /etc/ssh/ssh_host_dsa_key , | 167 | .Pa /etc/ssh/ssh_host_rsa_key , |
168 | .Pa /etc/ssh/ssh_host_ecdsa_key , | 168 | .Pa /etc/ssh/ssh_host_ecdsa_key |
169 | .Pa /etc/ssh/ssh_host_ed25519_key | ||
170 | and | 169 | and |
171 | .Pa /etc/ssh/ssh_host_rsa_key . | 170 | .Pa /etc/ssh/ssh_host_ed25519_key . |
172 | It is possible to have multiple host key files for | 171 | It is possible to have multiple host key files for |
173 | the different host key algorithms. | 172 | the different host key algorithms. |
174 | .It Fl i | 173 | .It Fl i |
diff --git a/sshd_config b/sshd_config index f68edf367..928229594 100644 --- a/sshd_config +++ b/sshd_config | |||
@@ -16,7 +16,6 @@ | |||
16 | #ListenAddress :: | 16 | #ListenAddress :: |
17 | 17 | ||
18 | #HostKey /etc/ssh/ssh_host_rsa_key | 18 | #HostKey /etc/ssh/ssh_host_rsa_key |
19 | #HostKey /etc/ssh/ssh_host_dsa_key | ||
20 | #HostKey /etc/ssh/ssh_host_ecdsa_key | 19 | #HostKey /etc/ssh/ssh_host_ecdsa_key |
21 | #HostKey /etc/ssh/ssh_host_ed25519_key | 20 | #HostKey /etc/ssh/ssh_host_ed25519_key |
22 | 21 | ||
diff --git a/sshd_config.5 b/sshd_config.5 index 16be4f628..ef520680f 100644 --- a/sshd_config.5 +++ b/sshd_config.5 | |||
@@ -749,11 +749,10 @@ is not to load any certificates. | |||
749 | Specifies a file containing a private host key | 749 | Specifies a file containing a private host key |
750 | used by SSH. | 750 | used by SSH. |
751 | The defaults are | 751 | The defaults are |
752 | .Pa /etc/ssh/ssh_host_dsa_key , | 752 | .Pa /etc/ssh/ssh_host_rsa_key , |
753 | .Pa /etc/ssh/ssh_host_ecdsa_key , | 753 | .Pa /etc/ssh/ssh_host_ecdsa_key |
754 | .Pa /etc/ssh/ssh_host_ed25519_key | ||
755 | and | 754 | and |
756 | .Pa /etc/ssh/ssh_host_rsa_key . | 755 | .Pa /etc/ssh/ssh_host_ed25519_key . |
757 | .Pp | 756 | .Pp |
758 | Note that | 757 | Note that |
759 | .Xr sshd 8 | 758 | .Xr sshd 8 |