This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree".

The branch, next has been updated via ea0033d96214b74ea69983d09214fe637f00eae8 (commit) via 04da8aa70acfa411ee124669a11e5b8a1eaf2921 (commit) from cec620efdf2d0ab2c55b015ca7b8d6ca2a667e72 (commit)

Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below.

- Log ----------------------------------------------------------------- commit ea0033d96214b74ea69983d09214fe637f00eae8 Author: Michael Tremer michael.tremer@ipfire.org Date: Thu Aug 20 23:26:49 2015 +0100

SSH: Replace old RSA keys with a new set

Signed-off-by: Michael Tremer michael.tremer@ipfire.org

commit 04da8aa70acfa411ee124669a11e5b8a1eaf2921 Author: Michael Tremer michael.tremer@ipfire.org Date: Thu Aug 20 23:20:44 2015 +0100

Do not create any DSA keys any more

DSA is considered weak cryptography

Signed-off-by: Michael Tremer michael.tremer@ipfire.org

-----------------------------------------------------------------------

Summary of changes: config/rootfiles/core/94/filelists/files | 1 + config/rootfiles/core/94/update.sh | 6 ++++++ src/initscripts/init.d/sshd | 14 +------------- 3 files changed, 8 insertions(+), 13 deletions(-)

Difference in files: diff --git a/config/rootfiles/core/94/filelists/files b/config/rootfiles/core/94/filelists/files index 168c7d1..2dce10a 100644 --- a/config/rootfiles/core/94/filelists/files +++ b/config/rootfiles/core/94/filelists/files @@ -1,3 +1,4 @@ etc/system-release etc/issue +etc/rc.d/init.d/sshd var/ipfire/langs diff --git a/config/rootfiles/core/94/update.sh b/config/rootfiles/core/94/update.sh index d92ef91..99c5e4f 100644 --- a/config/rootfiles/core/94/update.sh +++ b/config/rootfiles/core/94/update.sh @@ -45,6 +45,12 @@ extract_files sed -i /etc/ssh/sshd_config \ -e 's/^#?PermitRootLogin .*$$/PermitRootLogin yes/'

+# Move away old and unsupported keys +mv -f /etc/ssh/ssh_host_dsa_key{,.old} +# Regenerating weak RSA keys +mv -f /etc/ssh/ssh_host_key{,.old} +mv -f /etc/ssh/ssh_host_rsa_key{,.old} + # Start services /etc/init.d/dnsmasq start /etc/init.d/sshd start diff --git a/src/initscripts/init.d/sshd b/src/initscripts/init.d/sshd index 0ed8661..7b4092d 100644 --- a/src/initscripts/init.d/sshd +++ b/src/initscripts/init.d/sshd @@ -12,24 +12,12 @@

case "$1" in start) - if [ ! -e "/etc/ssh/ssh_host_key" ]; then - boot_mesg "Generating SSH host key..." - ssh-keygen -qf /etc/ssh/ssh_host_key -N '' -t rsa1 - evaluate_retval - fi - - for algo in rsa dsa ecdsa ed25519; do + for algo in rsa ecdsa ed25519; do keyfile="/etc/ssh/ssh_host_${algo}_key"

# If the key already exists, there is nothing to do. [ -e "${keyfile}" ] && continue

- case "${algo}" in - rsa) - algo="rsa1" - ;; - esac - boot_mesg "Generating SSH key (${algo})..." ssh-keygen -qf "${keyfile}" -N '' -t ${algo} evaluate_retval

hooks/post-receive -- IPFire 2.x development tree