From 812eea9a3a20afebc20b374a30ceac7f0d87c9b4 Mon Sep 17 00:00:00 2001 From: Christian Breunig Date: Sun, 14 Dec 2025 18:41:08 +0100 Subject: ssh: T8098: remove support for deprecated "rijndael-cbc@lysator.liu.se" cipher According to an Arch Linux forum discussion, the cipher rijndael-cbc@lysator.liu.se was removed in OpenSSH 6.7. References: - https://bbs.archlinux.org/viewtopic.php?id=188613 - https://www.openssh.org/txt/release-6.7 - https://github.com/openssh/openssh-portable/commit/03e93c753d7c223063a --- src/migration-scripts/ssh/2-to-3 | 31 +++++++++++++++++++++++++++++++ 1 file changed, 31 insertions(+) create mode 100644 src/migration-scripts/ssh/2-to-3 (limited to 'src/migration-scripts/ssh') diff --git a/src/migration-scripts/ssh/2-to-3 b/src/migration-scripts/ssh/2-to-3 new file mode 100644 index 000000000..e18a6aa05 --- /dev/null +++ b/src/migration-scripts/ssh/2-to-3 @@ -0,0 +1,31 @@ +# Copyright VyOS maintainers and contributors +# +# This library is free software; you can redistribute it and/or +# modify it under the terms of the GNU Lesser General Public +# License as published by the Free Software Foundation; either +# version 2.1 of the License, or (at your option) any later version. +# +# This library is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +# Lesser General Public License for more details. +# +# You should have received a copy of the GNU Lesser General Public License +# along with this library. If not, see . + +# T8098: rijndael-cbc@lysator.liu.se was removed in OpenSSH 6.7 which is used +# starting with VyOS 1.4 + +from vyos.configtree import ConfigTree + +base = ['service', 'ssh'] + +def migrate(config: ConfigTree) -> None: + if not config.exists(base + ['ciphers']): + # Nothing to do + return + + deprecated_cipher = 'rijndael-cbc@lysator.liu.se' + for cipher in config.return_values(base + ['ciphers']): + if cipher == deprecated_cipher: + config.delete_value(base + ['ciphers'], value=deprecated_cipher) -- cgit v1.2.3