43 ms·

They said it has been disabled by default for years. There is a cost to maintaining it and a security risk for untested code. I agree with this removal. > thos

They said it has been disabled by default for years. There is a cost to maintaining it and a security risk for untested code. I agree with this removal. > those systems cannot be fixed (old network hardware, doing V2V conversions from old RHEL, etc) How old are these old systems? V2V conversions? What version of RHEL?

Arnt 3y ago
I tried to look for active DSA keys now, and didn't see anything but don't feel confident that there are in fact none. Hmm.
- SoftTalker 3y ago
  Yeah old switches, BMCs, and other embedded SSH servers often use it. Really that stuff is too old to be using in a production environment but sometimes reality is different. Keep an older release of openssh if you need it for those. No sense keeping obsolete code for obsolete use cases in the codebase, it's a maintenance an testing headache and a security risk.
  - Arnt 3y ago
    I don't want to be nervous about whether I need it, I'd prefer an alert when it's used, turned on by default for a year.
    - roblabla 3y ago
      It's been disabled by default since 2015 - you need to enable support for them in the config file, otherwise the client will error out. In other words, if you don't have the following line in your ~/.ssh/config, you're fine: PubkeyAcceptedKeyTypes=+ssh-dss
      - Arnt 3y ago
        That's great. Do you know what happens when an old unattended client with an old old key connects to a new server?
        Symbiote 3y ago
        The same as happened last year, and will happen next year, since your old client isn't being updated.
        Arnt 3y ago
        So it's only being ditched from the clients, not the servers? I'm happy to hear that.
        Symbiote 3y ago
        Assuming you haven't edited it, I misread your comment and my reply is probably incorrect. You presumably have a configuration option allowing the old encryption in your server configuration, which is your warning that you're running a legacy system.
- deleted 3y ago
  [deleted]

Arnt 3y ago

I tried to look for active DSA keys now, and didn't see anything but don't feel confident that there are in fact none. Hmm.

SoftTalker 3y ago
Yeah old switches, BMCs, and other embedded SSH servers often use it. Really that stuff is too old to be using in a production environment but sometimes reality is different. Keep an older release of openssh if you need it for those. No sense keeping obsolete code for obsolete use cases in the codebase, it's a maintenance an testing headache and a security risk.
- Arnt 3y ago
  I don't want to be nervous about whether I need it, I'd prefer an alert when it's used, turned on by default for a year.
  - roblabla 3y ago
    It's been disabled by default since 2015 - you need to enable support for them in the config file, otherwise the client will error out. In other words, if you don't have the following line in your ~/.ssh/config, you're fine: PubkeyAcceptedKeyTypes=+ssh-dss
    - Arnt 3y ago
      That's great. Do you know what happens when an old unattended client with an old old key connects to a new server?
      - Symbiote 3y ago
        The same as happened last year, and will happen next year, since your old client isn't being updated.
        Arnt 3y ago
        So it's only being ditched from the clients, not the servers? I'm happy to hear that.
        Symbiote 3y ago
        Assuming you haven't edited it, I misread your comment and my reply is probably incorrect. You presumably have a configuration option allowing the old encryption in your server configuration, which is your warning that you're running a legacy system.
deleted 3y ago
[deleted]