Merge pull request #4731 from c-po/openssh-T7787

T7787: add deprecation warning for ssh-dss keys

1 files changed, 23 insertions, 0 deletions

diff --git a/src/conf_mode/service_ssh.py b/src/conf_mode/service_ssh.py
index bf8afe8b7..ca0e66207 100755
--- a/src/conf_mode/service_ssh.py
+++ b/src/conf_mode/service_ssh.py
@@ -16,15 +16,18 @@
 
 import os
 
+from copy import deepcopy
 from sys import exit
 from syslog import syslog
 from syslog import LOG_INFO
 
+from vyos.base import DeprecationWarning
 from vyos.config import Config
 from vyos.configdict import is_node_changed
 from vyos.configverify import verify_vrf
 from vyos.configverify import verify_pki_openssh_key
 from vyos.defaults import config_files
+from vyos.defaults import SSH_DSA_DEPRECATION_WARNING
 from vyos.utils.process import call
 from vyos.template import render
 from vyos import ConfigError
@@ -47,6 +50,13 @@ key_ed25519 = '/etc/ssh/ssh_host_ed25519_key'
 
 trusted_user_ca = config_files['sshd_user_ca']
 
+login_motd_dsa_warning = r'/run/motd.d/91-vyos-ssh-dsa-deprecation-warning'
+
+# As of OpenSSH 9.8p1 in Debian trixie, DSA keys are no longer supported
+deprecated_algos = ['ssh-dss', 'ssh-dss-cert-v01@openssh.com']
+SSH_DSA_DEPRECATION_WARNING: str = f'{SSH_DSA_DEPRECATION_WARNING} '\
+'The following hostkey-algorithms are in use:'
+
 def get_config(config=None):
     if config:
         conf = config
@@ -100,6 +110,12 @@ def verify(ssh):
     if 'trusted_user_ca' in ssh:
         verify_pki_openssh_key(ssh, ssh['trusted_user_ca'])
 
+    if 'hostkey_algorithm' in ssh:
+        tmp = any(item in deprecated_algos for item in ssh['hostkey_algorithm'])
+        if deprecated_algos:
+            tmp = ', '.join(deprecated_algos)
+            DeprecationWarning(f'{SSH_DSA_DEPRECATION_WARNING} {tmp}')
+
     verify_vrf(ssh)
     return None
 
@@ -137,6 +153,13 @@ def generate(ssh):
 
     render(config_file, 'ssh/sshd_config.j2', ssh)
 
+    # Generate MOTD informing the user(s) for possible deprecated SSH hostkey-algorithm
+    tmp = deepcopy(ssh)
+    tmp['ssh_dsa_deprecation_warning'] = f'DEPRECATION WARNING: {SSH_DSA_DEPRECATION_WARNING}'
+    tmp['deprecated_algos'] = deprecated_algos
+    render(login_motd_dsa_warning, 'ssh/motd_ssh_dsa_warning.j2', tmp,
+        permission=0o644, user='root', group='root')
+
     if 'dynamic_protection' in ssh:
         render(sshguard_config_file, 'ssh/sshguard_config.j2', ssh)
         render(sshguard_whitelist, 'ssh/sshguard_whitelist.j2', ssh)