From: "Fabian Grünbichler" <f.gruenbichler@proxmox.com>
To: Wolfgang Bumiller <w.bumiller@proxmox.com>,
Daniel Kral <d.kral@proxmox.com>
Cc: pve-devel@lists.proxmox.com
Subject: Re: [pve-devel] [RFC container] setup: remove deprecated dsa from ssh host key generation
Date: Fri, 27 Jun 2025 07:04:56 +0200 (CEST) [thread overview]
Message-ID: <2091234171.9248.1751000696115@192.168.2.153> (raw)
In-Reply-To: <36vrlauguwm7hnyjc3gybfea4tuqiymodmfkycmhydyo3bfweq@wsuqmlnmuhjc>
> Wolfgang Bumiller <w.bumiller@proxmox.com> hat am 26.06.2025 13:36 CEST geschrieben:
>
>
> On Wed, Jun 25, 2025 at 11:56:31AM +0200, Daniel Kral wrote:
> > OpenSSH 10.0 removes support for the DSA signature algorithm [0], which
> > is the base version that will be shipped for Debian 13 trixie [1]. Since
> > it has been marked deprecated for some time and generating DSA
> > signatures with OpenSSH 10.0 will fail, remove it.
>
> We should probably actively remove existing dsa host keys in case a
> container template ships them, just to make sure older distro containers
> won't end up all sharing the same DSA key when created on a trixie
> pve...
>
> In fact, maybe we should remove all files matching
> `/etc/ssh/ssh_host_*` in the setup code, in case there are types we
> missed?
that sounds like a good idea, but should probably be visibly logged.
for legacy distros (which are not the best fit for containers anyway)
it's always possible to generate keys if needed inside the container
afterwards..
> > [0] https://www.openssh.com/txt/release-10.0
> > [1] https://www.debian.org/releases/trixie/release-notes/whats-new.en.html
> >
> > Signed-off-by: Daniel Kral <d.kral@proxmox.com>
> > ---
> > Sending it as a RFC as I'm unsure if there's any other repercussions
> > removing it here. AFAICS it seems this is the only site where we
> > generate DSA signatures.
> >
> > src/PVE/LXC/Setup/Base.pm | 1 -
> > 1 file changed, 1 deletion(-)
> >
> > diff --git a/src/PVE/LXC/Setup/Base.pm b/src/PVE/LXC/Setup/Base.pm
> > index 6bdfb8d..dbfc775 100644
> > --- a/src/PVE/LXC/Setup/Base.pm
> > +++ b/src/PVE/LXC/Setup/Base.pm
> > @@ -646,7 +646,6 @@ sub ssh_host_key_types_to_generate {
> >
> > return {
> > rsa => 'ssh_host_rsa_key',
> > - dsa => 'ssh_host_dsa_key',
> > ecdsa => 'ssh_host_ecdsa_key',
> > ed25519 => 'ssh_host_ed25519_key',
> > };
> > --
> > 2.39.5
_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
next prev parent reply other threads:[~2025-06-27 5:04 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-06-25 9:56 Daniel Kral
2025-06-26 11:36 ` Wolfgang Bumiller
2025-06-27 5:04 ` Fabian Grünbichler [this message]
2025-06-27 8:20 ` Daniel Kral
2025-06-27 8:46 ` Fabian Grünbichler
2025-06-27 8:59 ` Daniel Kral
2025-06-27 9:06 ` Fabian Grünbichler
2025-06-27 9:44 ` Daniel Kral
2025-06-27 10:11 ` Fabian Grünbichler
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=2091234171.9248.1751000696115@192.168.2.153 \
--to=f.gruenbichler@proxmox.com \
--cc=d.kral@proxmox.com \
--cc=pve-devel@lists.proxmox.com \
--cc=w.bumiller@proxmox.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox