From 6deda171e8b5f5a65101436399bdbb308179e076 Mon Sep 17 00:00:00 2001 From: Christian Breunig Date: Wed, 17 Sep 2025 21:49:34 +0200 Subject: ssh: T7839: add deprecation warning for DSA hostkey-algorithm usage OpenSSH in Debian Trixie has removed support for ssh-dss (DSA) keys, which will prevent users with such keys from logging in after upgrade. To avoid lockouts, add a loud deprecation warning when users log in using a DSA key. This warning advises affected users to replace their keys with a supported algorithm (e.g., ed25519 or RSA) before the upgrade. Deprecation warning will be displayed during "commit" but also as MOTD to inform on this issue during every login. DEPRECATION WARNING: Support for SSH-DSA keys is deprecated and will be removed in VyOS 1.6. Please update affected keys to a supported algorithm (e.g., RSA, ECDSA or ED25519) to avoid authentication failures after the upgrade. The following hostkey-algorithms are in use: ssh-dss, ssh-dss-cert-v01@openssh.com --- python/vyos/defaults.py | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'python') diff --git a/python/vyos/defaults.py b/python/vyos/defaults.py index 5e3ba4e63..d06f4ea05 100644 --- a/python/vyos/defaults.py +++ b/python/vyos/defaults.py @@ -90,3 +90,8 @@ commit_hooks = {'pre': '/etc/commit/pre-hooks.d', } airbag_noteworthy_size = 20 + +SSH_DSA_DEPRECATION_WARNING: str = \ +'Support for SSH-DSA keys is deprecated and will be removed in VyOS 1.6. ' \ +'Please update affected keys to a supported algorithm (e.g., RSA, ECDSA or ' \ +'ED25519) to avoid authentication failures after the upgrade.' -- cgit v1.2.3