From 5fc5168dde0c840bf743058d235193fc27e61cab Mon Sep 17 00:00:00 2001
From: Colin Watson <cjwatson@debian.org>
Date: Mon, 16 Jan 2017 13:53:04 +0000
Subject: Remove ssh_host_dsa_key from HostKey default

The client no longer accepts DSA host keys, and servers using the
default HostKey setting should have better host keys available.

Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=2662
Bug-Debian: https://bugs.debian.org/850614
Last-Update: 2017-01-16

Patch-Name: no-dsa-host-key-by-default.patch
---
 servconf.c    | 2 --
 sshd.8        | 7 +++----
 sshd_config   | 1 -
 sshd_config.5 | 7 +++----
 4 files changed, 6 insertions(+), 11 deletions(-)

diff --git a/servconf.c b/servconf.c
index a391cf4b..1a7a5f18 100644
--- a/servconf.c
+++ b/servconf.c
@@ -204,8 +204,6 @@ fill_default_server_options(ServerOptions *options)
 		/* fill default hostkeys for protocols */
 		options->host_key_files[options->num_host_key_files++] =
 		    _PATH_HOST_RSA_KEY_FILE;
-		options->host_key_files[options->num_host_key_files++] =
-		    _PATH_HOST_DSA_KEY_FILE;
 #ifdef OPENSSL_HAS_ECC
 		options->host_key_files[options->num_host_key_files++] =
 		    _PATH_HOST_ECDSA_KEY_FILE;
diff --git a/sshd.8 b/sshd.8
index 6355178f..f038fb82 100644
--- a/sshd.8
+++ b/sshd.8
@@ -164,11 +164,10 @@ This option must be given if
 is not run as root (as the normal
 host key files are normally not readable by anyone but root).
 The default is
-.Pa /etc/ssh/ssh_host_dsa_key ,
-.Pa /etc/ssh/ssh_host_ecdsa_key ,
-.Pa /etc/ssh/ssh_host_ed25519_key
+.Pa /etc/ssh/ssh_host_rsa_key ,
+.Pa /etc/ssh/ssh_host_ecdsa_key
 and
-.Pa /etc/ssh/ssh_host_rsa_key .
+.Pa /etc/ssh/ssh_host_ed25519_key .
 It is possible to have multiple host key files for
 the different host key algorithms.
 .It Fl i
diff --git a/sshd_config b/sshd_config
index f68edf36..92822959 100644
--- a/sshd_config
+++ b/sshd_config
@@ -16,7 +16,6 @@
 #ListenAddress ::
 
 #HostKey /etc/ssh/ssh_host_rsa_key
-#HostKey /etc/ssh/ssh_host_dsa_key
 #HostKey /etc/ssh/ssh_host_ecdsa_key
 #HostKey /etc/ssh/ssh_host_ed25519_key
 
diff --git a/sshd_config.5 b/sshd_config.5
index cc5d9fb0..0747cc8b 100644
--- a/sshd_config.5
+++ b/sshd_config.5
@@ -741,11 +741,10 @@ is not to load any certificates.
 Specifies a file containing a private host key
 used by SSH.
 The defaults are
-.Pa /etc/ssh/ssh_host_dsa_key ,
-.Pa /etc/ssh/ssh_host_ecdsa_key ,
-.Pa /etc/ssh/ssh_host_ed25519_key
+.Pa /etc/ssh/ssh_host_rsa_key ,
+.Pa /etc/ssh/ssh_host_ecdsa_key
 and
-.Pa /etc/ssh/ssh_host_rsa_key .
+.Pa /etc/ssh/ssh_host_ed25519_key .
 .Pp
 Note that
 .Xr sshd 8