Debian Bug report logs - #823827
openssh-server: Should probably no longer generate DSA host keys on new installs

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Santiago Vila <sanvila@unex.es>

To: Debian BTS <submit@bugs.debian.org>

Subject: openssh-server: Should probably no longer generate DSA host keys on new installs

Date: Mon, 9 May 2016 13:39:10 +0200 (CEST)

[Message part 1 (text/plain, inline)]

Package: openssh-server
Version: 1:7.2p2-5
Tags: patch

Hello Colin.

Since the ssh client no longer wants to connect to a server which has
only a DSA key, because it's considered obsolete and not secure enough,
the logical thing to do for the Debian openssh-server package would be
to stop generating such keys on new systems as well.

[ Did this check: On a sid system I disabled all host keys but DSA and
  then was not able to ssh to localhost anymore ].

While we are at it, this change would also solve Bug #562593,
marked "important" (mips machine hangs at generating DSA2 key).

The attached patch may help, but I've not tested.

Thanks a lot.

[openssh.patch.txt (text/plain, attachment)]

Message #10 received at 823827@bugs.debian.org (full text, mbox, reply):

From: Colin Watson <cjwatson@debian.org>

To: Santiago Vila <sanvila@unex.es>, 823827@bugs.debian.org

Subject: Re: Bug#823827: openssh-server: Should probably no longer generate DSA host keys on new installs

Date: Fri, 22 Jul 2016 16:53:44 +0100

On Mon, May 09, 2016 at 01:39:10PM +0200, Santiago Vila wrote:
> Since the ssh client no longer wants to connect to a server which has
> only a DSA key, because it's considered obsolete and not secure enough,
> the logical thing to do for the Debian openssh-server package would be
> to stop generating such keys on new systems as well.

Thanks for this patch.  Mostly applied, though see below:

> @@ -114,8 +113,6 @@ create_keys() {
>  
>  	create_key "Creating SSH2 RSA key; this may take some time ..." \
>  		"$hostkeys" /etc/ssh/ssh_host_rsa_key -t rsa
> -	create_key "Creating SSH2 DSA key; this may take some time ..." \
> -		"$hostkeys" /etc/ssh/ssh_host_dsa_key -t dsa
>  	create_key "Creating SSH2 ECDSA key; this may take some time ..." \
>  		"$hostkeys" /etc/ssh/ssh_host_ecdsa_key -t ecdsa
>  	create_key "Creating SSH2 ED25519 key; this may take some time ..." \

I think it makes sense to omit this hunk of the patch for now.  Not
listing the keys in host_keys_required's defaults or in the
default-generated configuration file should be enough for now, and if a
host key is in fact explicitly listed in the configuration file then we
should IMO still generate it.

Cheers,

-- 
Colin Watson                                       [cjwatson@debian.org]

Message #15 received at 823827-close@bugs.debian.org (full text, mbox, reply):

From: Colin Watson <cjwatson@debian.org>

To: 823827-close@bugs.debian.org

Subject: Bug#823827: fixed in openssh 1:7.2p2-6

Date: Fri, 22 Jul 2016 17:26:14 +0000

Source: openssh
Source-Version: 1:7.2p2-6

We believe that the bug you reported is fixed in the latest version of
openssh, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 823827@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Colin Watson <cjwatson@debian.org> (supplier of updated openssh package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Fri, 22 Jul 2016 17:06:19 +0100
Source: openssh
Binary: openssh-client openssh-client-ssh1 openssh-server openssh-sftp-server ssh ssh-krb5 ssh-askpass-gnome openssh-client-udeb openssh-server-udeb
Architecture: source
Version: 1:7.2p2-6
Distribution: unstable
Urgency: medium
Maintainer: Debian OpenSSH Maintainers <debian-ssh@lists.debian.org>
Changed-By: Colin Watson <cjwatson@debian.org>
Description:
 openssh-client - secure shell (SSH) client, for secure access to remote machines
 openssh-client-ssh1 - secure shell (SSH) client for legacy SSH1 protocol
 openssh-client-udeb - secure shell client for the Debian installer (udeb)
 openssh-server - secure shell (SSH) server, for secure access from remote machines
 openssh-server-udeb - secure shell server for the Debian installer (udeb)
 openssh-sftp-server - secure shell (SSH) sftp server module, for SFTP access from remot
 ssh        - secure shell client and server (metapackage)
 ssh-askpass-gnome - interactive X program to prompt users for a passphrase for ssh-ad
 ssh-krb5   - secure shell client and server (transitional package)
Closes: 714526 751636 766887 822997 823827 831902
Changes:
 openssh (1:7.2p2-6) unstable; urgency=medium
 .
   * debian/watch: Switch to HTTP (thanks, Nicholas Luedtke; closes:
     #822997).
   * Copy summary of supported SFTP protocol versions from upstream's
     PROTOCOL file into the openssh-sftp-server package description (closes:
     #766887).
   * Set SSH_PROGRAM=/usr/bin/ssh1 when building openssh-client-ssh1 so that
     scp1 works (reported by Olivier MATZ).
   * Retroactively add a NEWS.Debian entry for the UseDNS change in 6.9 (see
     LP #1588457).
   * CVE-2016-6210: Mitigate user enumeration via covert timing channel
     (closes: #831902).
   * Backport upstream patch to close ControlPersist background process
     stderr when not in debug mode or when logging to a file or syslog
     (closes: #714526).
   * Add a session cleanup script and a systemd unit file to trigger it,
     which serves to terminate SSH sessions cleanly if systemd doesn't do
     that itself, often because libpam-systemd is not installed (thanks,
     Vivek Das Mohapatra, Tom Hutter, and others; closes: #751636).
   * Stop generating DSA host keys by default (thanks, Santiago Vila; closes:
     #823827).
Checksums-Sha1:
 2170a722d423c610aebff6c7d46851fb88316348 2837 openssh_7.2p2-6.dsc
 74c23afda7155665754613e32106434aa5ae105f 154028 openssh_7.2p2-6.debian.tar.xz
Checksums-Sha256:
 2e071288cb930a73414d8cd2c4050b8db583970df13ec7ee47a0150c87b8382e 2837 openssh_7.2p2-6.dsc
 d02a0ad674537b470348807e522496f3c06f7893bfd11b5de809a9cfa5b1176f 154028 openssh_7.2p2-6.debian.tar.xz
Files:
 6b199afe03c15f81d0e758383fee1200 2837 net standard openssh_7.2p2-6.dsc
 15f3b542b8e3378a329acd5eb86ac9a8 154028 net standard openssh_7.2p2-6.debian.tar.xz

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
Comment: Colin Watson <cjwatson@debian.org> -- Debian developer

iQIVAwUBV5JHkDk1h9l9hlALAQj+hQ/+PBz3IIxgy7hxdy/H+j3nIBIk6nhRV3By
gVQIkNo7t0mnSlfQmQtyVrdzuPuiwItLgYzhNOODIyAqNBxuQVLbv3bNH1Y9n3Do
2SB+KTAxHoKIqF2323r1n0OjIlpot7aI8uX6jZ+Cv5BMQwwtZMqgmlwJll1PUeSL
LVbGVOwy3iOZcNpSAWi7LRcoRMdsNi5myqFB03exOq3026zDmjGEUgrpJC6Dhjyi
lQ64vS/neB97Ww8XtWRclmdnTA0d2VuTS5uvzTGVihV2VZtaRi6WTl4kbiABYRES
YnYFcKQnV4rI7yXTGLXzBeSmWowanzeGW8ppFg3HYQx43rR9pJ/UYX/g2PVVqVvx
Y+W9t10AMX7Fn9PnbY905nAig4kp3GgOWqV5tTaaupVzWXlPIlOmKNvvfnuCJJDk
P3U5vIMueTt+7FOapcbj6MnMktLeoqwrij0alD4CiLF0KTo1PCLM/mkQY76tBwEP
UcbSMBlFhsy4OBLq3qOR017NSo1TXdfSF7CpA/VB9bzbJkHULuVs17G/oHhBV4X/
6QH1AiH0bLReuTxCqbD/uoIjMbOkCjvUHCUbXGdXSMctyv1zYiw7uZJwpB6XU0Do
vmuKMn2IoDtow5OlSD0akLRaXTaNCH2N8Kg5pgPVzIG5XUiJZWoS4U6b8lzuzctz
/2yteQ0fDcQ=
=33BL
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.