Ssh – the current need for ssh dsa host keys

ssh

When I started dealing with *nix servers, openssh servers came with dsa as well as rsa host keys, with openssh clients preferring the rsa key. These days openssh servers have dsa, rsa as well as ecdsa host keys, with openssh clients preferring the ecdsa host key.

To what extent do I still need/want to have openssh configured to provide dsa host keys?

Mostly wondering in regards to non-openssh client implementations.

Best Answer

I can't think of anything widely used that lacks support for at least RSA, and really if you are using a terminal emulator on windows (for example) that only supports DSA you should stop using it and download putty, or update it.

The option is there to provide compatibility. However, it also adds to your security surface; an attacker could weaken your cryptography by convincing a client to only declare support for DSA. This scenario is rather far-fetched. If it concerns you, then you should disable DSA.

The only scenario I can imagine that would likely result in a serious compromise is if one of your users used a DSA keypair on an untrusted or compromised computer which always negotiated DSA and generated duplicate ephemeral values for creating DSA signatures; the result would be that the user's key could be compromised, but it doesn't seem like this is the path of least resistance for an attacker. Unless your system is used by international spies, you probably don't need to worry about it. See this question on one of our sister sites: https://security.stackexchange.com/q/29262/12223.

There isn't really a direct way to disable DSA. Debian bug 528046 proposes it and provides a patch (for an option PubKeyTypes), and met with support, but has not been actioned since 2009, with no evidence of anything upstream.

Related Solutions

SSH Keys – Add Correct Host Key in Known Hosts for Multiple SSH Host Keys

get the rsa key of your server, where server_ip is your server's IP address, such as 192.168.2.1:

$ ssh-keyscan -t rsa server_ip

Sample response:

# server_ip SSH-2.0-OpenSSH_4.3
server_ip ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAwH5EXZG...

and on the client, copy the entire response line server_ip ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAwH5EXZG..., and add this key to the bottom of your ~/.ssh/known_hosts file:

server_ip ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAqx9m529...(the offending key, and/or the very bottom of the `known_hosts` file)
server_ip ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAwH5EXZG... (line you're adding, copied and pasted from above)

Ssh – Best current authentication cipher for SSH2? Are certain ones only allowed/not allowed? How to tell what cipher an existing key is

TLDR: Use 2048bit RSA keys.

Unless you're using an ancient SSH client or server, you'll be using protocol version 2.

While the DSA and RSA algorithms are comparable in terms of strength, DSA keys may only be 1024bit when used by SSH whereas RSA keys are not limited. 1024bit keys are becoming insecure with the computing power available today, and so you want at least 2048bit, which means RSA. (There also used to be patent issues with RSA which caused DSA to be recommended, but these are no longer the case.)

Pretty much all servers will accept DSA and RSA keys. (Some specific keys are blacklisted due to a Debian bug, but there aren't any disallowed ciphers.) ECDSA is the new hotness, but not all servers support it yet and so it isn't widely usable. Once that changes ECDSA will probably be the way to go.

You can usually tell the type of key by the filename, which is usually id_dsa, id_rsa or id_ecdsa. The file command can also inspect the contains to determine the type:

% file id_rsa
id_rsa: PEM RSA private key

To determine the key length you can use the openssl command:

% openssl rsa -in id_rsa -noout -text | head -n1
Enter pass phrase for id_rsa:
Private-Key: (4096 bit)
% openssl dsa -in id_dsa -noout -text | head -n1
read DSA key
Private-Key: (1024 bit)

Best Answer

Related Solutions

SSH Keys – Add Correct Host Key in Known Hosts for Multiple SSH Host Keys

Ssh – Best current authentication cipher for SSH2? Are certain ones only allowed/not allowed? How to tell what cipher an existing key is

Related Topic