20

Today, after doing updates in Debian Stretch, it started displaying these warnings when restarting the ssh service with my current config:

/etc/ssh/sshd_config line 17: Deprecated option KeyRegenerationInterval
/etc/ssh/sshd_config line 18: Deprecated option ServerKeyBits
/etc/ssh/sshd_config line 29: Deprecated option RSAAuthentication
/etc/ssh/sshd_config line 36: Deprecated option RhostsRSAAuthentication
[....] Restarting OpenBSD Secure Shell server: sshd
/etc/ssh/sshd_config line 17: Deprecated option KeyRegenerationInterval
/etc/ssh/sshd_config line 18: Deprecated option ServerKeyBits
/etc/ssh/sshd_config line 29: Deprecated option RSAAuthentication
/etc/ssh/sshd_config line 36: Deprecated option RhostsRSAAuthentication

What is happening here?

Using Debian 9 with OpenSSH 7.4

23

In the current Stretch update, openssh version changed from 7.3 to 7.4, released on 2016-Dec-19.

As it can be inferred from the Release notes, and from @Jakuje comments, OpenSSH maintainers have removed the corresponding configuration options for good, as they are obsolete.

So the lines can be safely removed.

Also, take head of:

Future deprecation notice

We plan on retiring more legacy cryptography in future releases, specifically:

  • In approximately August 2017, removing remaining support for the
    SSH v.1 protocol (client-only and currently compile-time disabled).

  • In the same release, removing support for Blowfish and RC4 ciphers and the RIPE-MD160 HMAC. (These are currently run-time disabled).

  • Refusing all RSA keys smaller than 1024 bits (the current minimum
    is 768 bits)

  • The next release of OpenSSH will remove support for running sshd(8) with privilege separation disabled.

  • The next release of portable OpenSSH will remove support for
    OpenSSL version prior to 1.0.1.

  • 2
    nope. This functionality is gone for few versions. Now they only removed the configuration options (because they didn't have any effect on SSH2). The problem is that you have configuration file not shipped by your distribution for some time (containing these options). – Jakuje Jan 16 '17 at 15:50
  • @Jakuje Interesting, I really did not pay attention to the client-only remark in the release notes until now. – Rui F Ribeiro Jan 16 '17 at 15:59
19

You can remove deprecated configuration lines with this:

sed -i '/KeyRegenerationInterval/d' /etc/ssh/sshd_config
sed -i '/ServerKeyBits/d' /etc/ssh/sshd_config
sed -i '/RSAAuthentication/d' /etc/ssh/sshd_config
sed -i '/RhostsRSAAuthentication/d' /etc/ssh/sshd_config
sed -i '/UsePrivilegeSeparation/d' /etc/ssh/sshd_config

And restart SSH daemon: systemctl restart sshd

  • 3
    Hi, congratulations on your first post. while your answer is technically correct, the question is more concerned with the whys than how to do it. – Rui F Ribeiro May 31 '17 at 13:42
  • 1
    Yeah, you're right, thanks for pointing out. – Xdg May 31 '17 at 15:13
  • Nevertheless is this is a useful answer. – Jasen May 1 at 5:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.