[2015-08-12 20:24:07 +0200] Jens Adam: > Thu, 13 Aug 2015 00:03:59 +0900 > Gaetan Bisson <[email protected]>: > > > Hi, > > > > I'd like to suggest the following piece of news to be posted when > > openssh-7.0p1-1 lands in [core]: > > > > > > The new openssh-7.0p1 release deprecates certain types of SSH keys > > that are now considered vulnerable. For details, see the > > [upstream > > announcement](http://lists.mindrot.org/pipermail/openssh-unix-announce/2015-August/000122.html). > > > > Before updating and restarting sshd on remote hosts, if you rely on > > SSH keys for authentication, please make sure that you have a recent > > key pair set up, or alternative means of logging in (such as using > > password authentication). > > Perhaps you could clarify that this only affects people using ssh-dss > keys for authentication and how to check for them, e.g. "use 'grep > ssh-dss ~/.ssh/{known_hosts,authorized_keys*,*.pub}' to find legacy > keys".
Oh, sure. Here's a new proposal: The new `openssh-7.0p1` release deprecates keys of `ssh-dss` type (also known as DSA) in light of recently discovered vulnerabilities. For details, see the [upstream announcement](http://lists.mindrot.org/pipermail/openssh-unix-announce/2015-August/000122.html). Before updating and restarting sshd on remote hosts, make sure you do not rely solely on DSA keys for connecting to it. You may enumerate DSA keys that allow connecting to a remote account with: grep ssh-dss ~/.ssh/authorized_keys If you have any, ensure you have alternative means of logging in (such a key pair of a different type, or password authentication). Note that host keys of `ssh-dss` type are also deprecated; if you were relying on them to connect to a server, after updating it, you will have to confirm the fingerprint of a key of another type to reconnect. -- Gaetan
signature.asc
Description: PGP signature
