41

Today, after doing updates in Debian Stretch, it started displaying these warnings when restarting the ssh service with my current config:

/etc/ssh/sshd_config line 17: Deprecated option KeyRegenerationInterval
/etc/ssh/sshd_config line 18: Deprecated option ServerKeyBits
/etc/ssh/sshd_config line 29: Deprecated option RSAAuthentication
/etc/ssh/sshd_config line 36: Deprecated option RhostsRSAAuthentication
[....] Restarting OpenBSD Secure Shell server: sshd
/etc/ssh/sshd_config line 17: Deprecated option KeyRegenerationInterval
/etc/ssh/sshd_config line 18: Deprecated option ServerKeyBits
/etc/ssh/sshd_config line 29: Deprecated option RSAAuthentication
/etc/ssh/sshd_config line 36: Deprecated option RhostsRSAAuthentication

What is happening here?

Using Debian 9 with OpenSSH 7.4

Improve this question

2 Answers 2

Reset to default
39

In the current Stretch update, openssh version changed from 7.3 to 7.4, released on 2016-Dec-19.

As it can be inferred from the Release notes, and from @Jakuje comments, OpenSSH maintainers have removed the corresponding configuration options for good, as they are obsolete.

So the lines can be safely removed.

Also, take head of:

Future deprecation notice

We plan on retiring more legacy cryptography in future releases, specifically:

  • In approximately August 2017, removing remaining support for the
    SSH v.1 protocol (client-only and currently compile-time disabled).

  • In the same release, removing support for Blowfish and RC4 ciphers and the RIPE-MD160 HMAC. (These are currently run-time disabled).

  • Refusing all RSA keys smaller than 1024 bits (the current minimum
    is 768 bits)

  • The next release of OpenSSH will remove support for running sshd(8) with privilege separation disabled.

  • The next release of portable OpenSSH will remove support for
    OpenSSL version prior to 1.0.1.

Improve this answer
2
  • 2
    nope. This functionality is gone for few versions. Now they only removed the configuration options (because they didn't have any effect on SSH2). The problem is that you have configuration file not shipped by your distribution for some time (containing these options).
    – Jakuje
    Jan 16, 2017 at 15:50
  • 1
    @Jakuje Interesting, I really did not pay attention to the client-only remark in the release notes until now.
    – Rui F Ribeiro
    Jan 16, 2017 at 15:59
31

You can remove deprecated configuration lines with this:

sed -i '/KeyRegenerationInterval/d' /etc/ssh/sshd_config
sed -i '/ServerKeyBits/d' /etc/ssh/sshd_config
sed -i '/RSAAuthentication/d' /etc/ssh/sshd_config
sed -i '/RhostsRSAAuthentication/d' /etc/ssh/sshd_config
sed -i '/UsePrivilegeSeparation/d' /etc/ssh/sshd_config

And restart SSH daemon: systemctl restart sshd

Improve this answer
4
  • 6
    Hi, congratulations on your first post. while your answer is technically correct, the question is more concerned with the whys than how to do it.
    – Rui F Ribeiro
    May 31, 2017 at 13:42
  • 1
    Yeah, you're right, thanks for pointing out.
    – Xdg
    May 31, 2017 at 15:13
  • 2
    Nevertheless is this is a useful answer.
    – Jasen
    May 1, 2019 at 5:05
  • 4
    ..and confirms it is safe to do so without requiring any newly introduced preferred options ?
    – mckenzm
    Jul 4, 2019 at 2:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .