TE
TechEcho
Home24h TopNewestBestAskShowJobs
GitHubTwitter
Home

TechEcho

A tech news platform built with Next.js, providing global tech news and discussions.

GitHubTwitter

Home

HomeNewestBestAskShowJobs

Resources

HackerNews APIOriginal HackerNewsNext.js

© 2025 TechEcho. All rights reserved.

RSA/SHA1 signature type disabled by default in OpenSSH

58 pointsby rodrigo975over 3 years ago

2 comments

hannobover 3 years ago
Key point to avoid any confusion: This is about the RSA-SHA1 cipher combination. It does <i>not</i> mean that RSA is deprecated.<p>If you use an RSA key for SSH (server or client) you can continue using that.<p>This should not affect any modern-day SSH implementation, it will only cut off compatibility with SSH implementations not updated for a very long time.
评论 #28371756 未加载
kevinoidover 3 years ago
I&#x27;ve been running with ssh-rsa disabled for a while (with a config based on <a href="https:&#x2F;&#x2F;infosec.mozilla.org&#x2F;guidelines&#x2F;openssh#modern-openssh-67" rel="nofollow">https:&#x2F;&#x2F;infosec.mozilla.org&#x2F;guidelines&#x2F;openssh#modern-openss...</a> ) and it&#x27;s been pretty smooth. Support for better algorithms is widespread, with a few exceptions (like bazaar.launchpad.net).<p>One gotcha: OpenWrt does not enable ECDSA by default[1] and only recently enabled support for ed25519 by default.[2][3] It&#x27;s available in release candidates for 21.02, but not in current stable releases. So if you&#x27;re running a stable release you&#x27;ll need to either add `PubkeyAcceptedKeyTypes +ssh-rsa` to your client ssh_config or use a custom build of OpenWrt with DROPBEAR_ECC or DROPBEAR_ECC_FULL enabled.<p>[1]: <a href="https:&#x2F;&#x2F;bugs.openwrt.org&#x2F;index.php?do=details&amp;task_id=786" rel="nofollow">https:&#x2F;&#x2F;bugs.openwrt.org&#x2F;index.php?do=details&amp;task_id=786</a><p>[2]: <a href="https:&#x2F;&#x2F;git.openwrt.org&#x2F;?p=openwrt&#x2F;openwrt.git;a=commit;h=d0f295837a03f7f52000ae6d395827bdde7996a4" rel="nofollow">https:&#x2F;&#x2F;git.openwrt.org&#x2F;?p=openwrt&#x2F;openwrt.git;a=commit;h=d0...</a><p>[3]: <a href="https:&#x2F;&#x2F;bugs.openwrt.org&#x2F;index.php?do=details&amp;task_id=3216&amp;string=dropbear" rel="nofollow">https:&#x2F;&#x2F;bugs.openwrt.org&#x2F;index.php?do=details&amp;task_id=3216&amp;s...</a><p>[4]: <a href="https:&#x2F;&#x2F;bugs.openwrt.org&#x2F;index.php?do=details&amp;task_id=3452" rel="nofollow">https:&#x2F;&#x2F;bugs.openwrt.org&#x2F;index.php?do=details&amp;task_id=3452</a>
评论 #28373476 未加载