diff options
| author | Christian Breunig <christian@breunig.cc> | 2025-09-17 21:49:34 +0200 |
|---|---|---|
| committer | Christian Breunig <christian@breunig.cc> | 2025-09-17 21:49:34 +0200 |
| commit | 6deda171e8b5f5a65101436399bdbb308179e076 (patch) | |
| tree | 69237bfd0c9b340615c7dd1ed494b7b9a6c88d2e /python | |
| parent | a5b55e588acff8c07a96c02b523160be725f00ee (diff) | |
| download | vyos-1x-6deda171e8b5f5a65101436399bdbb308179e076.tar.gz vyos-1x-6deda171e8b5f5a65101436399bdbb308179e076.zip | |
ssh: T7839: add deprecation warning for DSA hostkey-algorithm usage
OpenSSH in Debian Trixie has removed support for ssh-dss (DSA) keys, which will
prevent users with such keys from logging in after upgrade. To avoid lockouts,
add a loud deprecation warning when users log in using a DSA key. This warning
advises affected users to replace their keys with a supported algorithm (e.g.,
ed25519 or RSA) before the upgrade.
Deprecation warning will be displayed during "commit" but also as MOTD to inform
on this issue during every login.
DEPRECATION WARNING: Support for SSH-DSA keys is deprecated and will
be removed in VyOS 1.6. Please update affected keys to a supported
algorithm (e.g., RSA, ECDSA or ED25519) to avoid authentication
failures after the upgrade. The following hostkey-algorithms are in
use: ssh-dss, ssh-dss-cert-v01@openssh.com
Diffstat (limited to 'python')
| -rw-r--r-- | python/vyos/defaults.py | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/python/vyos/defaults.py b/python/vyos/defaults.py index 5e3ba4e63..d06f4ea05 100644 --- a/python/vyos/defaults.py +++ b/python/vyos/defaults.py @@ -90,3 +90,8 @@ commit_hooks = {'pre': '/etc/commit/pre-hooks.d', } airbag_noteworthy_size = 20 + +SSH_DSA_DEPRECATION_WARNING: str = \ +'Support for SSH-DSA keys is deprecated and will be removed in VyOS 1.6. ' \ +'Please update affected keys to a supported algorithm (e.g., RSA, ECDSA or ' \ +'ED25519) to avoid authentication failures after the upgrade.' |