From 64c5743751c5f37ec012eeaace44b91e2f5eeee1 Mon Sep 17 00:00:00 2001 From: zeripath Date: Fri, 9 Oct 2020 07:52:57 +0100 Subject: [PATCH] Disable DSA ssh keys by default (#13056) * Disable DSA ssh keys by default OpenSSH has disabled DSA keys since version 7.0 As the docker runs openssh > v7.0 we should just disable DSA keys by default. Refers to #11417 Signed-off-by: Andrew Thornton * Just disable DSA keys by default Signed-off-by: Andrew Thornton * Appears we need to set the minimum key sizes too Signed-off-by: Andrew Thornton * Appears we need to set the minimum key sizes too Signed-off-by: Andrew Thornton * Remove DSA type * Fix Tests Co-authored-by: techknowlogick Co-authored-by: Lauris BH --- doc/advanced/config-cheat-sheet.en-us.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/doc/advanced/config-cheat-sheet.en-us.md b/doc/advanced/config-cheat-sheet.en-us.md index c2a12a1d..36d5af1a 100644 --- a/doc/advanced/config-cheat-sheet.en-us.md +++ b/doc/advanced/config-cheat-sheet.en-us.md @@ -258,7 +258,7 @@ Values containing `#` or `;` must be quoted using `` ` `` or `"""`. - `SSH_KEYGEN_PATH`: **ssh-keygen**: Path to ssh-keygen, default is 'ssh-keygen' which means the shell is responsible for finding out which one to call. - `SSH_BACKUP_AUTHORIZED_KEYS`: **true**: Enable SSH Authorized Key Backup when rewriting all keys, default is true. - `SSH_EXPOSE_ANONYMOUS`: **false**: Enable exposure of SSH clone URL to anonymous visitors, default is false. -- `MINIMUM_KEY_SIZE_CHECK`: **false**: Indicate whether to check minimum key size with corresponding type. +- `MINIMUM_KEY_SIZE_CHECK`: **true**: Indicate whether to check minimum key size with corresponding type. - `OFFLINE_MODE`: **false**: Disables use of CDN for static files and Gravatar for profile pictures. - `DISABLE_ROUTER_LOG`: **false**: Mute printing of the router log. @@ -479,7 +479,7 @@ Define allowed algorithms and their minimum key length (use -1 to disable a type - `ED25519`: **256** - `ECDSA`: **256** - `RSA`: **2048** -- `DSA`: **1024** +- `DSA`: **-1**: DSA is now disabled by default. Set to **1024** to re-enable but ensure you may need to reconfigure your SSHD provider ## Webhook (`webhook`)