Merge pull request #4731 from c-po/openssh-T7787

T7787: add deprecation warning for ssh-dss keys

2 files changed, 26 insertions, 0 deletions

diff --git a/data/templates/login/motd_user_dsa_warning.j2 b/data/templates/login/motd_user_dsa_warning.j2
new file mode 100644
index 000000000..f8164b184
--- /dev/null
+++ b/data/templates/login/motd_user_dsa_warning.j2
@@ -0,0 +1,18 @@
+{% if user is vyos_defined %}
+{%     set ns = namespace (gen_header = True) %}
+{%     for user, user_config in user.items() %}
+{%         if user_config.authentication.public_keys is vyos_defined %}
+{%             for key, key_options in user_config.authentication.public_keys.items() %}
+{%                 if key_options.type is vyos_defined('ssh-dss') %}
+{%                     if ns.gen_header %}
+{%                         set ns.gen_header = False %}
+---
+{{ ssh_dsa_deprecation_warning | wordwrap(72) }}
+
+{%                     endif %}
+User "{{ user }}" with deprecated public-key named: {{ key }}
+{%                 endif %}
+{%             endfor %}
+{%         endif %}
+{%     endfor %}
+{% endif %}
diff --git a/data/templates/ssh/motd_ssh_dsa_warning.j2 b/data/templates/ssh/motd_ssh_dsa_warning.j2
new file mode 100644
index 000000000..2d4598fa8
--- /dev/null
+++ b/data/templates/ssh/motd_ssh_dsa_warning.j2
@@ -0,0 +1,8 @@
+{% if hostkey_algorithm is vyos_defined %}
+{%     set tmp = hostkey_algorithm | select("in", deprecated_algos) %}
+{%     if tmp %}
+{%         set tmp = ssh_dsa_deprecation_warning ~ ' ' ~  tmp | join(', ') %}
+---
+{{ tmp | wordwrap(72) }}
+{%     endif %}
+{% endif %}