diff options
| author | Christian Breunig <christian@breunig.cc> | 2025-09-17 21:49:34 +0200 |
|---|---|---|
| committer | Christian Breunig <christian@breunig.cc> | 2025-09-17 21:49:34 +0200 |
| commit | 6deda171e8b5f5a65101436399bdbb308179e076 (patch) | |
| tree | 69237bfd0c9b340615c7dd1ed494b7b9a6c88d2e /data | |
| parent | a5b55e588acff8c07a96c02b523160be725f00ee (diff) | |
| download | vyos-1x-6deda171e8b5f5a65101436399bdbb308179e076.tar.gz vyos-1x-6deda171e8b5f5a65101436399bdbb308179e076.zip | |
ssh: T7839: add deprecation warning for DSA hostkey-algorithm usage
OpenSSH in Debian Trixie has removed support for ssh-dss (DSA) keys, which will
prevent users with such keys from logging in after upgrade. To avoid lockouts,
add a loud deprecation warning when users log in using a DSA key. This warning
advises affected users to replace their keys with a supported algorithm (e.g.,
ed25519 or RSA) before the upgrade.
Deprecation warning will be displayed during "commit" but also as MOTD to inform
on this issue during every login.
DEPRECATION WARNING: Support for SSH-DSA keys is deprecated and will
be removed in VyOS 1.6. Please update affected keys to a supported
algorithm (e.g., RSA, ECDSA or ED25519) to avoid authentication
failures after the upgrade. The following hostkey-algorithms are in
use: ssh-dss, ssh-dss-cert-v01@openssh.com
Diffstat (limited to 'data')
| -rw-r--r-- | data/templates/login/motd_user_dsa_warning.j2 | 2 | ||||
| -rw-r--r-- | data/templates/ssh/motd_ssh_dsa_warning.j2 | 8 |
2 files changed, 9 insertions, 1 deletions
diff --git a/data/templates/login/motd_user_dsa_warning.j2 b/data/templates/login/motd_user_dsa_warning.j2 index d3db18ff7..f8164b184 100644 --- a/data/templates/login/motd_user_dsa_warning.j2 +++ b/data/templates/login/motd_user_dsa_warning.j2 @@ -6,7 +6,7 @@ {% if key_options.type is vyos_defined('ssh-dss') %} {% if ns.gen_header %} {% set ns.gen_header = False %} - +--- {{ ssh_dsa_deprecation_warning | wordwrap(72) }} {% endif %} diff --git a/data/templates/ssh/motd_ssh_dsa_warning.j2 b/data/templates/ssh/motd_ssh_dsa_warning.j2 new file mode 100644 index 000000000..2d4598fa8 --- /dev/null +++ b/data/templates/ssh/motd_ssh_dsa_warning.j2 @@ -0,0 +1,8 @@ +{% if hostkey_algorithm is vyos_defined %} +{% set tmp = hostkey_algorithm | select("in", deprecated_algos) %} +{% if tmp %} +{% set tmp = ssh_dsa_deprecation_warning ~ ' ' ~ tmp | join(', ') %} +--- +{{ tmp | wordwrap(72) }} +{% endif %} +{% endif %} |