summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--debian/.git-dpm4
-rw-r--r--debian/changelog1
-rw-r--r--debian/patches/no-dsa-host-key-by-default.patch83
-rw-r--r--debian/patches/series1
-rw-r--r--servconf.c2
-rw-r--r--sshd.87
-rw-r--r--sshd_config1
-rw-r--r--sshd_config.57
8 files changed, 93 insertions, 13 deletions
diff --git a/debian/.git-dpm b/debian/.git-dpm
index 53fbcd41e..6f9925b66 100644
--- a/debian/.git-dpm
+++ b/debian/.git-dpm
@@ -1,6 +1,6 @@
1# see git-dpm(1) from git-dpm package 1# see git-dpm(1) from git-dpm package
2e346421ca6852fbf9f95cf0e764ecc345e5ce21d 279d4110c92f82de854b10b2d96df9daaaaeaec3a
3e346421ca6852fbf9f95cf0e764ecc345e5ce21d 379d4110c92f82de854b10b2d96df9daaaaeaec3a
4971a7653746a6972b907dfe0ce139c06e4a6f482 4971a7653746a6972b907dfe0ce139c06e4a6f482
5971a7653746a6972b907dfe0ce139c06e4a6f482 5971a7653746a6972b907dfe0ce139c06e4a6f482
6openssh_7.4p1.orig.tar.gz 6openssh_7.4p1.orig.tar.gz
diff --git a/debian/changelog b/debian/changelog
index a7a936707..a65e90c78 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -5,6 +5,7 @@ openssh (1:7.4p1-6) UNRELEASED; urgency=medium
5 gone. 5 gone.
6 * Document sshd_config changes that may be needed following the removal of 6 * Document sshd_config changes that may be needed following the removal of
7 protocol 1 support from sshd (closes: #851573). 7 protocol 1 support from sshd (closes: #851573).
8 * Remove ssh_host_dsa_key from HostKey default (closes: #850614).
8 9
9 -- Colin Watson <cjwatson@debian.org> Fri, 06 Jan 2017 08:40:14 +0000 10 -- Colin Watson <cjwatson@debian.org> Fri, 06 Jan 2017 08:40:14 +0000
10 11
diff --git a/debian/patches/no-dsa-host-key-by-default.patch b/debian/patches/no-dsa-host-key-by-default.patch
new file mode 100644
index 000000000..cd5bd34a4
--- /dev/null
+++ b/debian/patches/no-dsa-host-key-by-default.patch
@@ -0,0 +1,83 @@
1From 79d4110c92f82de854b10b2d96df9daaaaeaec3a Mon Sep 17 00:00:00 2001
2From: Colin Watson <cjwatson@debian.org>
3Date: Mon, 16 Jan 2017 13:53:04 +0000
4Subject: Remove ssh_host_dsa_key from HostKey default
5
6The client no longer accepts DSA host keys, and servers using the
7default HostKey setting should have better host keys available.
8
9Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=2662
10Bug-Debian: https://bugs.debian.org/850614
11Last-Update: 2017-01-16
12
13Patch-Name: no-dsa-host-key-by-default.patch
14---
15 servconf.c | 2 --
16 sshd.8 | 7 +++----
17 sshd_config | 1 -
18 sshd_config.5 | 7 +++----
19 4 files changed, 6 insertions(+), 11 deletions(-)
20
21diff --git a/servconf.c b/servconf.c
22index 1cee3d6c..202c4506 100644
23--- a/servconf.c
24+++ b/servconf.c
25@@ -204,8 +204,6 @@ fill_default_server_options(ServerOptions *options)
26 /* fill default hostkeys for protocols */
27 options->host_key_files[options->num_host_key_files++] =
28 _PATH_HOST_RSA_KEY_FILE;
29- options->host_key_files[options->num_host_key_files++] =
30- _PATH_HOST_DSA_KEY_FILE;
31 #ifdef OPENSSL_HAS_ECC
32 options->host_key_files[options->num_host_key_files++] =
33 _PATH_HOST_ECDSA_KEY_FILE;
34diff --git a/sshd.8 b/sshd.8
35index 38a72540..e8f1fde8 100644
36--- a/sshd.8
37+++ b/sshd.8
38@@ -167,11 +167,10 @@ This option must be given if
39 is not run as root (as the normal
40 host key files are normally not readable by anyone but root).
41 The default is
42-.Pa /etc/ssh/ssh_host_dsa_key ,
43-.Pa /etc/ssh/ssh_host_ecdsa_key ,
44-.Pa /etc/ssh/ssh_host_ed25519_key
45+.Pa /etc/ssh/ssh_host_rsa_key ,
46+.Pa /etc/ssh/ssh_host_ecdsa_key
47 and
48-.Pa /etc/ssh/ssh_host_rsa_key .
49+.Pa /etc/ssh/ssh_host_ed25519_key .
50 It is possible to have multiple host key files for
51 the different host key algorithms.
52 .It Fl i
53diff --git a/sshd_config b/sshd_config
54index 13cbe2c6..4aea6c72 100644
55--- a/sshd_config
56+++ b/sshd_config
57@@ -16,7 +16,6 @@
58 #ListenAddress ::
59
60 #HostKey /etc/ssh/ssh_host_rsa_key
61-#HostKey /etc/ssh/ssh_host_dsa_key
62 #HostKey /etc/ssh/ssh_host_ecdsa_key
63 #HostKey /etc/ssh/ssh_host_ed25519_key
64
65diff --git a/sshd_config.5 b/sshd_config.5
66index 703a9cdd..8f8fbb66 100644
67--- a/sshd_config.5
68+++ b/sshd_config.5
69@@ -733,11 +733,10 @@ is not to load any certificates.
70 Specifies a file containing a private host key
71 used by SSH.
72 The defaults are
73-.Pa /etc/ssh/ssh_host_dsa_key ,
74-.Pa /etc/ssh/ssh_host_ecdsa_key ,
75-.Pa /etc/ssh/ssh_host_ed25519_key
76+.Pa /etc/ssh/ssh_host_rsa_key ,
77+.Pa /etc/ssh/ssh_host_ecdsa_key
78 and
79-.Pa /etc/ssh/ssh_host_rsa_key .
80+.Pa /etc/ssh/ssh_host_ed25519_key .
81 .Pp
82 Note that
83 .Xr sshd 8
diff --git a/debian/patches/series b/debian/patches/series
index 7edc511b8..6eae81080 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -28,3 +28,4 @@ regress-integrity-robust.patch
28regress-forwarding-race.patch 28regress-forwarding-race.patch
29regress-mktemp.patch 29regress-mktemp.patch
30sandbox-x32-workaround.patch 30sandbox-x32-workaround.patch
31no-dsa-host-key-by-default.patch
diff --git a/servconf.c b/servconf.c
index 1cee3d6c2..202c45066 100644
--- a/servconf.c
+++ b/servconf.c
@@ -204,8 +204,6 @@ fill_default_server_options(ServerOptions *options)
204 /* fill default hostkeys for protocols */ 204 /* fill default hostkeys for protocols */
205 options->host_key_files[options->num_host_key_files++] = 205 options->host_key_files[options->num_host_key_files++] =
206 _PATH_HOST_RSA_KEY_FILE; 206 _PATH_HOST_RSA_KEY_FILE;
207 options->host_key_files[options->num_host_key_files++] =
208 _PATH_HOST_DSA_KEY_FILE;
209#ifdef OPENSSL_HAS_ECC 207#ifdef OPENSSL_HAS_ECC
210 options->host_key_files[options->num_host_key_files++] = 208 options->host_key_files[options->num_host_key_files++] =
211 _PATH_HOST_ECDSA_KEY_FILE; 209 _PATH_HOST_ECDSA_KEY_FILE;
diff --git a/sshd.8 b/sshd.8
index 38a72540d..e8f1fde8c 100644
--- a/sshd.8
+++ b/sshd.8
@@ -167,11 +167,10 @@ This option must be given if
167is not run as root (as the normal 167is not run as root (as the normal
168host key files are normally not readable by anyone but root). 168host key files are normally not readable by anyone but root).
169The default is 169The default is
170.Pa /etc/ssh/ssh_host_dsa_key , 170.Pa /etc/ssh/ssh_host_rsa_key ,
171.Pa /etc/ssh/ssh_host_ecdsa_key , 171.Pa /etc/ssh/ssh_host_ecdsa_key
172.Pa /etc/ssh/ssh_host_ed25519_key
173and 172and
174.Pa /etc/ssh/ssh_host_rsa_key . 173.Pa /etc/ssh/ssh_host_ed25519_key .
175It is possible to have multiple host key files for 174It is possible to have multiple host key files for
176the different host key algorithms. 175the different host key algorithms.
177.It Fl i 176.It Fl i
diff --git a/sshd_config b/sshd_config
index 13cbe2c66..4aea6c729 100644
--- a/sshd_config
+++ b/sshd_config
@@ -16,7 +16,6 @@
16#ListenAddress :: 16#ListenAddress ::
17 17
18#HostKey /etc/ssh/ssh_host_rsa_key 18#HostKey /etc/ssh/ssh_host_rsa_key
19#HostKey /etc/ssh/ssh_host_dsa_key
20#HostKey /etc/ssh/ssh_host_ecdsa_key 19#HostKey /etc/ssh/ssh_host_ecdsa_key
21#HostKey /etc/ssh/ssh_host_ed25519_key 20#HostKey /etc/ssh/ssh_host_ed25519_key
22 21
diff --git a/sshd_config.5 b/sshd_config.5
index 703a9cddc..8f8fbb66d 100644
--- a/sshd_config.5
+++ b/sshd_config.5
@@ -733,11 +733,10 @@ is not to load any certificates.
733Specifies a file containing a private host key 733Specifies a file containing a private host key
734used by SSH. 734used by SSH.
735The defaults are 735The defaults are
736.Pa /etc/ssh/ssh_host_dsa_key , 736.Pa /etc/ssh/ssh_host_rsa_key ,
737.Pa /etc/ssh/ssh_host_ecdsa_key , 737.Pa /etc/ssh/ssh_host_ecdsa_key
738.Pa /etc/ssh/ssh_host_ed25519_key
739and 738and
740.Pa /etc/ssh/ssh_host_rsa_key . 739.Pa /etc/ssh/ssh_host_ed25519_key .
741.Pp 740.Pp
742Note that 741Note that
743.Xr sshd 8 742.Xr sshd 8