Hacker News Reader

Comment by csdreamer7 | Hacker News Reader

They said it has been disabled by default for years. There is a cost to maintaining it and a security risk for untested code. I agree with this removal.

> those systems cannot be fixed (old network hardware, doing V2V conversions from old RHEL, etc)

How old are these old systems? V2V conversions? What version of RHEL?

View on HN

I tried to look for active DSA keys now, and didn't see anything but don't feel confident that there are in fact none.

Hmm.

Yeah old switches, BMCs, and other embedded SSH servers often use it. Really that stuff is too old to be using in a production environment but sometimes reality is different.

Keep an older release of openssh if you need it for those. No sense keeping obsolete code for obsolete use cases in the codebase, it's a maintenance an testing headache and a security risk.

I don't want to be nervous about whether I need it, I'd prefer an alert when it's used, turned on by default for a year.

It's been disabled by default since 2015 - you need to enable support for them in the config file, otherwise the client will error out. In other words, if you don't have the following line in your ~/.ssh/config, you're fine:

PubkeyAcceptedKeyTypes=+ssh-dss

That's great. Do you know what happens when an old unattended client with an old old key connects to a new server?

The same as happened last year, and will happen next year, since your old client isn't being updated.

So it's only being ditched from the clients, not the servers? I'm happy to hear that.

Assuming you haven't edited it, I misread your comment and my reply is probably incorrect.

You presumably have a configuration option allowing the old encryption in your server configuration, which is your warning that you're running a legacy system.

Reply on news.ycombinator.com