2

With the 7.0 release, OpenSSH disabled ssh-dss keys. The not-so-recommended workaround is to explicitly re-add DSA key support to .ssh/config, which will eventually be dropped by a later OpenSSH version:

PubkeyAcceptedKeyTypes=+ssh-dss

As I have deployed my DSA key to countless machines (and I do not have a full list of them, as known_hosts is hashed), I have to replace the old public user key whenever I encounter it on login.

Is it possible to make the OpenSSH client display a warning when I log in with an ssh-dss key?

Improve this question

1 Answer 1

Reset to default
2

There is no special mechanism in ssh to notify you that you use some key. It works or fails.

Differentiate the keys using passphrase

Only other idea that comes to my mind is differentiate between the keys using passphrase.

For example, have the RSA keys in ssh-agent or without passphrase and the DSA one with passphrase (and not in ssh-agent). It might warn you with passphrase prompt.

Not to use them

The easiest thing is not to add the above line into ssh_config and then you will see when you can't connect. Then you can use the options on command line for individual connections:

ssh -oPubkeyAcceptedKeyTypes=+ssh-dss host
Improve this answer
2
  • The problem with disabling DSA globally is that I will fallback to password logins, which is not a very suggesting symptom for "DSA key deployed". However, your "Passphrase" approach works. Can you please put it as your primary answer, so I can accept it?
    – ge0rg
    Feb 3, 2016 at 14:37
  • Updated the answer. Glad to help.
    – Jakuje
    Feb 3, 2016 at 15:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .