Page MenuHomeVyOS Platform
Create Task
Maniphest T7839

Add a deprecation warning for ssh-dss keys
Closed, DuplicatePublicFEATURE REQUEST
Actions

Description

Summary

The OpenSSH version from Trixie removes support for ssh-dss keys completely. Since people with such keys would be locked out, we need to make a really loud deprecation warning about that.

If the user uses an ssh-dss key, they should get a warning on login that they need to update the key to a supported algorithm.

Details

Version
-
Is it a breaking change?
Config syntax change (non-migratable)
Issue type
Feature/functionality removal

Related Objects
Search...

StatusSubtypeAssignedTask
 Needs testingFEATURE REQUESTNoneT7557 Use Debian trixie as a build base for Docker and the VyOS image
 DuplicateFEATURE REQUESTc-poT7839 Add a deprecation warning for ssh-dss keys

Event Timeline

c-po created this task.Sep 17 2025, 4:52 PM
c-po changed the task status from Open to In progress.
c-po claimed this task.
c-po triaged this task as High priority.
c-po added a comment.Sep 18 2025, 2:11 PM

https://github.com/vyos/vyos-1x/pull/4731

c-po moved this task from Need Triage to Completed on the VyOS Rolling board.Sep 18 2025, 2:19 PM
c-po added a project: VyOS 1.4 Sagitta (1.4.4).
c-po mentioned this in rVYOSONEX6af9055be987: login: T7839: add deprecation warning for DSS public-key usage.Sep 18 2025, 2:20 PM
c-po mentioned this in rVYOSONEX6deda171e8b5: ssh: T7839: add deprecation warning for DSA hostkey-algorithm usage.
Restricted Repository Identity mentioned this in rVYOSONEXc2a1c90156eb: Merge pull request #4736 from c-po/ssh-hostkey-algo.Sep 21 2025, 8:39 PM
c-po mentioned this in rVYOSONEX7aa35eff5961: ssh: T7839: fix warning on deprecated algorithms during commit.Sep 21 2025, 8:39 PM
c-po moved this task from Open to Finished on the VyOS 1.5 Circinus (1.5-stream-2025-Q3) board.Sep 23 2025, 2:03 PM
c-po closed this task as Resolved.Sep 23 2025, 2:08 PM
c-po moved this task from Backlog to Finished on the VyOS 1.4 Sagitta (1.4.4) board.
Viacheslav mentioned this in T7705: Add a deprecation warning for SSH DSA keys.Sep 24 2025, 11:55 PM
Viacheslav closed this task as a duplicate of T7705: Add a deprecation warning for SSH DSA keys.
dmbaturin merged a task: T7705: Add a deprecation warning for SSH DSA keys.Oct 28 2025, 2:40 PM
dmbaturin subscribed.
dmbaturin edited projects, added VyOS 1.5 Circinus (2025.11); removed VyOS 1.4 Sagitta (1.4.4), VyOS 1.5 Circinus (1.5-stream-2025-Q3), VyOS Rolling.Wed, Nov 12, 6:35 PM