Do not create any DSA keys any more

DSA is considered weak cryptography

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

diff --git a/config/rootfiles/core/94/filelists/files b/config/rootfiles/core/94/filelists/files
index 168c7d188b168dbae0b0001b8a01b6abe242c563..2dce10a105a5c59712c270783f2f2db901a68fb9 100644 (file)
--- a/config/rootfiles/core/94/filelists/files
+++ b/config/rootfiles/core/94/filelists/files
@@ -1,3 +1,4 @@
 etc/system-release
 etc/issue
+etc/rc.d/init.d/sshd
 var/ipfire/langs

diff --git a/config/rootfiles/core/94/update.sh b/config/rootfiles/core/94/update.sh
index d92ef916ba8fc058e2d3862469a1334009c85a6e..0d77743e87229b65ddf9b3c154cefb4c44f52d71 100644 (file)
--- a/config/rootfiles/core/94/update.sh
+++ b/config/rootfiles/core/94/update.sh
@@ -45,6 +45,9 @@ extract_files
 sed -i /etc/ssh/sshd_config \
        -e 's/^#\?PermitRootLogin .*$$/PermitRootLogin yes/'
 
+# Move away old and unsupported keys
+mv -f /etc/ssh/ssh_host_dsa_key{,.old}
+
 # Start services
 /etc/init.d/dnsmasq start
 /etc/init.d/sshd start

diff --git a/src/initscripts/init.d/sshd b/src/initscripts/init.d/sshd
index 0ed86616534c23d4bffcf1bae1e4c3b9b7986533..7533184f062fa694e6846a19c4617afee2c50aed 100644 (file)
--- a/src/initscripts/init.d/sshd
+++ b/src/initscripts/init.d/sshd
@@ -18,7 +18,7 @@ case "$1" in
                evaluate_retval
        fi
 
-       for algo in rsa dsa ecdsa ed25519; do
+       for algo in rsa ecdsa ed25519; do
                keyfile="/etc/ssh/ssh_host_${algo}_key"
 
                # If the key already exists, there is nothing to do.