Deprecated options when restarting openssh in Stretch

The name of the pictureThe name of the pictureThe name of the pictureClash Royale CLAN TAG#URR8PPP












17















Today, after doing updates in Debian Stretch, it started displaying these warnings when restarting the ssh service with my current config:



/etc/ssh/sshd_config line 17: Deprecated option KeyRegenerationInterval
/etc/ssh/sshd_config line 18: Deprecated option ServerKeyBits
/etc/ssh/sshd_config line 29: Deprecated option RSAAuthentication
/etc/ssh/sshd_config line 36: Deprecated option RhostsRSAAuthentication
[....] Restarting OpenBSD Secure Shell server: sshd
/etc/ssh/sshd_config line 17: Deprecated option KeyRegenerationInterval
/etc/ssh/sshd_config line 18: Deprecated option ServerKeyBits
/etc/ssh/sshd_config line 29: Deprecated option RSAAuthentication
/etc/ssh/sshd_config line 36: Deprecated option RhostsRSAAuthentication


What is happening here?



Using Debian 9 with OpenSSH 7.4










share|improve this question




























    17















    Today, after doing updates in Debian Stretch, it started displaying these warnings when restarting the ssh service with my current config:



    /etc/ssh/sshd_config line 17: Deprecated option KeyRegenerationInterval
    /etc/ssh/sshd_config line 18: Deprecated option ServerKeyBits
    /etc/ssh/sshd_config line 29: Deprecated option RSAAuthentication
    /etc/ssh/sshd_config line 36: Deprecated option RhostsRSAAuthentication
    [....] Restarting OpenBSD Secure Shell server: sshd
    /etc/ssh/sshd_config line 17: Deprecated option KeyRegenerationInterval
    /etc/ssh/sshd_config line 18: Deprecated option ServerKeyBits
    /etc/ssh/sshd_config line 29: Deprecated option RSAAuthentication
    /etc/ssh/sshd_config line 36: Deprecated option RhostsRSAAuthentication


    What is happening here?



    Using Debian 9 with OpenSSH 7.4










    share|improve this question


























      17












      17








      17


      4






      Today, after doing updates in Debian Stretch, it started displaying these warnings when restarting the ssh service with my current config:



      /etc/ssh/sshd_config line 17: Deprecated option KeyRegenerationInterval
      /etc/ssh/sshd_config line 18: Deprecated option ServerKeyBits
      /etc/ssh/sshd_config line 29: Deprecated option RSAAuthentication
      /etc/ssh/sshd_config line 36: Deprecated option RhostsRSAAuthentication
      [....] Restarting OpenBSD Secure Shell server: sshd
      /etc/ssh/sshd_config line 17: Deprecated option KeyRegenerationInterval
      /etc/ssh/sshd_config line 18: Deprecated option ServerKeyBits
      /etc/ssh/sshd_config line 29: Deprecated option RSAAuthentication
      /etc/ssh/sshd_config line 36: Deprecated option RhostsRSAAuthentication


      What is happening here?



      Using Debian 9 with OpenSSH 7.4










      share|improve this question
















      Today, after doing updates in Debian Stretch, it started displaying these warnings when restarting the ssh service with my current config:



      /etc/ssh/sshd_config line 17: Deprecated option KeyRegenerationInterval
      /etc/ssh/sshd_config line 18: Deprecated option ServerKeyBits
      /etc/ssh/sshd_config line 29: Deprecated option RSAAuthentication
      /etc/ssh/sshd_config line 36: Deprecated option RhostsRSAAuthentication
      [....] Restarting OpenBSD Secure Shell server: sshd
      /etc/ssh/sshd_config line 17: Deprecated option KeyRegenerationInterval
      /etc/ssh/sshd_config line 18: Deprecated option ServerKeyBits
      /etc/ssh/sshd_config line 29: Deprecated option RSAAuthentication
      /etc/ssh/sshd_config line 36: Deprecated option RhostsRSAAuthentication


      What is happening here?



      Using Debian 9 with OpenSSH 7.4







      debian openssh






      share|improve this question















      share|improve this question













      share|improve this question




      share|improve this question








      edited Jan 2 at 15:54







      Rui F Ribeiro

















      asked Jan 16 '17 at 14:21









      Rui F RibeiroRui F Ribeiro

      39.5k1479132




      39.5k1479132




















          2 Answers
          2






          active

          oldest

          votes


















          21














          In the current Stretch update, openssh version changed from 7.3 to 7.4, released on 2016-Dec-19.



          As it can be inferred from the Release notes, and from @Jakuje comments, OpenSSH maintainers have removed the corresponding configuration options for good, as they are obsolete.



          So the lines can be safely removed.



          Also, take head of:




          Future deprecation notice



          We plan on retiring more legacy cryptography in future releases,
          specifically:



          • In approximately August 2017, removing remaining support for the

            SSH v.1 protocol (client-only and currently compile-time disabled).


          • In the same release, removing support for Blowfish and RC4 ciphers
            and the RIPE-MD160 HMAC. (These are currently run-time disabled).


          • Refusing all RSA keys smaller than 1024 bits (the current minimum

            is 768 bits)


          • The next release of OpenSSH will remove support for running sshd(8)
            with privilege separation disabled.


          • The next release of portable OpenSSH will remove support for

            OpenSSL version prior to 1.0.1.







          share|improve this answer




















          • 2





            nope. This functionality is gone for few versions. Now they only removed the configuration options (because they didn't have any effect on SSH2). The problem is that you have configuration file not shipped by your distribution for some time (containing these options).

            – Jakuje
            Jan 16 '17 at 15:50











          • @Jakuje Interesting, I really did not pay attention to the client-only remark in the release notes until now.

            – Rui F Ribeiro
            Jan 16 '17 at 15:59



















          17














          You can remove deprecated configuration lines with this:



          sed -i '/KeyRegenerationInterval/d' /etc/ssh/sshd_config
          sed -i '/ServerKeyBits/d' /etc/ssh/sshd_config
          sed -i '/RSAAuthentication/d' /etc/ssh/sshd_config
          sed -i '/RhostsRSAAuthentication/d' /etc/ssh/sshd_config
          sed -i '/UsePrivilegeSeparation/d' /etc/ssh/sshd_config


          And restart SSH daemon: systemctl restart sshd






          share|improve this answer




















          • 3





            Hi, congratulations on your first post. while your answer is technically correct, the question is more concerned with the whys than how to do it.

            – Rui F Ribeiro
            May 31 '17 at 13:42






          • 1





            Yeah, you're right, thanks for pointing out.

            – Xdg
            May 31 '17 at 15:13










          Your Answer








          StackExchange.ready(function()
          var channelOptions =
          tags: "".split(" "),
          id: "106"
          ;
          initTagRenderer("".split(" "), "".split(" "), channelOptions);

          StackExchange.using("externalEditor", function()
          // Have to fire editor after snippets, if snippets enabled
          if (StackExchange.settings.snippets.snippetsEnabled)
          StackExchange.using("snippets", function()
          createEditor();
          );

          else
          createEditor();

          );

          function createEditor()
          StackExchange.prepareEditor(
          heartbeatType: 'answer',
          autoActivateHeartbeat: false,
          convertImagesToLinks: false,
          noModals: true,
          showLowRepImageUploadWarning: true,
          reputationToPostImages: null,
          bindNavPrevention: true,
          postfix: "",
          imageUploader:
          brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
          contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
          allowUrls: true
          ,
          onDemand: true,
          discardSelector: ".discard-answer"
          ,immediatelyShowMarkdownHelp:true
          );



          );













          draft saved

          draft discarded


















          StackExchange.ready(
          function ()
          StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f337774%2fdeprecated-options-when-restarting-openssh-in-stretch%23new-answer', 'question_page');

          );

          Post as a guest















          Required, but never shown

























          2 Answers
          2






          active

          oldest

          votes








          2 Answers
          2






          active

          oldest

          votes









          active

          oldest

          votes






          active

          oldest

          votes









          21














          In the current Stretch update, openssh version changed from 7.3 to 7.4, released on 2016-Dec-19.



          As it can be inferred from the Release notes, and from @Jakuje comments, OpenSSH maintainers have removed the corresponding configuration options for good, as they are obsolete.



          So the lines can be safely removed.



          Also, take head of:




          Future deprecation notice



          We plan on retiring more legacy cryptography in future releases,
          specifically:



          • In approximately August 2017, removing remaining support for the

            SSH v.1 protocol (client-only and currently compile-time disabled).


          • In the same release, removing support for Blowfish and RC4 ciphers
            and the RIPE-MD160 HMAC. (These are currently run-time disabled).


          • Refusing all RSA keys smaller than 1024 bits (the current minimum

            is 768 bits)


          • The next release of OpenSSH will remove support for running sshd(8)
            with privilege separation disabled.


          • The next release of portable OpenSSH will remove support for

            OpenSSL version prior to 1.0.1.







          share|improve this answer




















          • 2





            nope. This functionality is gone for few versions. Now they only removed the configuration options (because they didn't have any effect on SSH2). The problem is that you have configuration file not shipped by your distribution for some time (containing these options).

            – Jakuje
            Jan 16 '17 at 15:50











          • @Jakuje Interesting, I really did not pay attention to the client-only remark in the release notes until now.

            – Rui F Ribeiro
            Jan 16 '17 at 15:59
















          21














          In the current Stretch update, openssh version changed from 7.3 to 7.4, released on 2016-Dec-19.



          As it can be inferred from the Release notes, and from @Jakuje comments, OpenSSH maintainers have removed the corresponding configuration options for good, as they are obsolete.



          So the lines can be safely removed.



          Also, take head of:




          Future deprecation notice



          We plan on retiring more legacy cryptography in future releases,
          specifically:



          • In approximately August 2017, removing remaining support for the

            SSH v.1 protocol (client-only and currently compile-time disabled).


          • In the same release, removing support for Blowfish and RC4 ciphers
            and the RIPE-MD160 HMAC. (These are currently run-time disabled).


          • Refusing all RSA keys smaller than 1024 bits (the current minimum

            is 768 bits)


          • The next release of OpenSSH will remove support for running sshd(8)
            with privilege separation disabled.


          • The next release of portable OpenSSH will remove support for

            OpenSSL version prior to 1.0.1.







          share|improve this answer




















          • 2





            nope. This functionality is gone for few versions. Now they only removed the configuration options (because they didn't have any effect on SSH2). The problem is that you have configuration file not shipped by your distribution for some time (containing these options).

            – Jakuje
            Jan 16 '17 at 15:50











          • @Jakuje Interesting, I really did not pay attention to the client-only remark in the release notes until now.

            – Rui F Ribeiro
            Jan 16 '17 at 15:59














          21












          21








          21







          In the current Stretch update, openssh version changed from 7.3 to 7.4, released on 2016-Dec-19.



          As it can be inferred from the Release notes, and from @Jakuje comments, OpenSSH maintainers have removed the corresponding configuration options for good, as they are obsolete.



          So the lines can be safely removed.



          Also, take head of:




          Future deprecation notice



          We plan on retiring more legacy cryptography in future releases,
          specifically:



          • In approximately August 2017, removing remaining support for the

            SSH v.1 protocol (client-only and currently compile-time disabled).


          • In the same release, removing support for Blowfish and RC4 ciphers
            and the RIPE-MD160 HMAC. (These are currently run-time disabled).


          • Refusing all RSA keys smaller than 1024 bits (the current minimum

            is 768 bits)


          • The next release of OpenSSH will remove support for running sshd(8)
            with privilege separation disabled.


          • The next release of portable OpenSSH will remove support for

            OpenSSL version prior to 1.0.1.







          share|improve this answer















          In the current Stretch update, openssh version changed from 7.3 to 7.4, released on 2016-Dec-19.



          As it can be inferred from the Release notes, and from @Jakuje comments, OpenSSH maintainers have removed the corresponding configuration options for good, as they are obsolete.



          So the lines can be safely removed.



          Also, take head of:




          Future deprecation notice



          We plan on retiring more legacy cryptography in future releases,
          specifically:



          • In approximately August 2017, removing remaining support for the

            SSH v.1 protocol (client-only and currently compile-time disabled).


          • In the same release, removing support for Blowfish and RC4 ciphers
            and the RIPE-MD160 HMAC. (These are currently run-time disabled).


          • Refusing all RSA keys smaller than 1024 bits (the current minimum

            is 768 bits)


          • The next release of OpenSSH will remove support for running sshd(8)
            with privilege separation disabled.


          • The next release of portable OpenSSH will remove support for

            OpenSSL version prior to 1.0.1.








          share|improve this answer














          share|improve this answer



          share|improve this answer








          edited May 19 '17 at 3:56

























          answered Jan 16 '17 at 14:21









          Rui F RibeiroRui F Ribeiro

          39.5k1479132




          39.5k1479132







          • 2





            nope. This functionality is gone for few versions. Now they only removed the configuration options (because they didn't have any effect on SSH2). The problem is that you have configuration file not shipped by your distribution for some time (containing these options).

            – Jakuje
            Jan 16 '17 at 15:50











          • @Jakuje Interesting, I really did not pay attention to the client-only remark in the release notes until now.

            – Rui F Ribeiro
            Jan 16 '17 at 15:59













          • 2





            nope. This functionality is gone for few versions. Now they only removed the configuration options (because they didn't have any effect on SSH2). The problem is that you have configuration file not shipped by your distribution for some time (containing these options).

            – Jakuje
            Jan 16 '17 at 15:50











          • @Jakuje Interesting, I really did not pay attention to the client-only remark in the release notes until now.

            – Rui F Ribeiro
            Jan 16 '17 at 15:59








          2




          2





          nope. This functionality is gone for few versions. Now they only removed the configuration options (because they didn't have any effect on SSH2). The problem is that you have configuration file not shipped by your distribution for some time (containing these options).

          – Jakuje
          Jan 16 '17 at 15:50





          nope. This functionality is gone for few versions. Now they only removed the configuration options (because they didn't have any effect on SSH2). The problem is that you have configuration file not shipped by your distribution for some time (containing these options).

          – Jakuje
          Jan 16 '17 at 15:50













          @Jakuje Interesting, I really did not pay attention to the client-only remark in the release notes until now.

          – Rui F Ribeiro
          Jan 16 '17 at 15:59






          @Jakuje Interesting, I really did not pay attention to the client-only remark in the release notes until now.

          – Rui F Ribeiro
          Jan 16 '17 at 15:59














          17














          You can remove deprecated configuration lines with this:



          sed -i '/KeyRegenerationInterval/d' /etc/ssh/sshd_config
          sed -i '/ServerKeyBits/d' /etc/ssh/sshd_config
          sed -i '/RSAAuthentication/d' /etc/ssh/sshd_config
          sed -i '/RhostsRSAAuthentication/d' /etc/ssh/sshd_config
          sed -i '/UsePrivilegeSeparation/d' /etc/ssh/sshd_config


          And restart SSH daemon: systemctl restart sshd






          share|improve this answer




















          • 3





            Hi, congratulations on your first post. while your answer is technically correct, the question is more concerned with the whys than how to do it.

            – Rui F Ribeiro
            May 31 '17 at 13:42






          • 1





            Yeah, you're right, thanks for pointing out.

            – Xdg
            May 31 '17 at 15:13















          17














          You can remove deprecated configuration lines with this:



          sed -i '/KeyRegenerationInterval/d' /etc/ssh/sshd_config
          sed -i '/ServerKeyBits/d' /etc/ssh/sshd_config
          sed -i '/RSAAuthentication/d' /etc/ssh/sshd_config
          sed -i '/RhostsRSAAuthentication/d' /etc/ssh/sshd_config
          sed -i '/UsePrivilegeSeparation/d' /etc/ssh/sshd_config


          And restart SSH daemon: systemctl restart sshd






          share|improve this answer




















          • 3





            Hi, congratulations on your first post. while your answer is technically correct, the question is more concerned with the whys than how to do it.

            – Rui F Ribeiro
            May 31 '17 at 13:42






          • 1





            Yeah, you're right, thanks for pointing out.

            – Xdg
            May 31 '17 at 15:13













          17












          17








          17







          You can remove deprecated configuration lines with this:



          sed -i '/KeyRegenerationInterval/d' /etc/ssh/sshd_config
          sed -i '/ServerKeyBits/d' /etc/ssh/sshd_config
          sed -i '/RSAAuthentication/d' /etc/ssh/sshd_config
          sed -i '/RhostsRSAAuthentication/d' /etc/ssh/sshd_config
          sed -i '/UsePrivilegeSeparation/d' /etc/ssh/sshd_config


          And restart SSH daemon: systemctl restart sshd






          share|improve this answer















          You can remove deprecated configuration lines with this:



          sed -i '/KeyRegenerationInterval/d' /etc/ssh/sshd_config
          sed -i '/ServerKeyBits/d' /etc/ssh/sshd_config
          sed -i '/RSAAuthentication/d' /etc/ssh/sshd_config
          sed -i '/RhostsRSAAuthentication/d' /etc/ssh/sshd_config
          sed -i '/UsePrivilegeSeparation/d' /etc/ssh/sshd_config


          And restart SSH daemon: systemctl restart sshd







          share|improve this answer














          share|improve this answer



          share|improve this answer








          edited Aug 3 '18 at 19:44

























          answered May 31 '17 at 12:25









          XdgXdg

          27124




          27124







          • 3





            Hi, congratulations on your first post. while your answer is technically correct, the question is more concerned with the whys than how to do it.

            – Rui F Ribeiro
            May 31 '17 at 13:42






          • 1





            Yeah, you're right, thanks for pointing out.

            – Xdg
            May 31 '17 at 15:13












          • 3





            Hi, congratulations on your first post. while your answer is technically correct, the question is more concerned with the whys than how to do it.

            – Rui F Ribeiro
            May 31 '17 at 13:42






          • 1





            Yeah, you're right, thanks for pointing out.

            – Xdg
            May 31 '17 at 15:13







          3




          3





          Hi, congratulations on your first post. while your answer is technically correct, the question is more concerned with the whys than how to do it.

          – Rui F Ribeiro
          May 31 '17 at 13:42





          Hi, congratulations on your first post. while your answer is technically correct, the question is more concerned with the whys than how to do it.

          – Rui F Ribeiro
          May 31 '17 at 13:42




          1




          1





          Yeah, you're right, thanks for pointing out.

          – Xdg
          May 31 '17 at 15:13





          Yeah, you're right, thanks for pointing out.

          – Xdg
          May 31 '17 at 15:13

















          draft saved

          draft discarded
















































          Thanks for contributing an answer to Unix & Linux Stack Exchange!


          • Please be sure to answer the question. Provide details and share your research!

          But avoid


          • Asking for help, clarification, or responding to other answers.

          • Making statements based on opinion; back them up with references or personal experience.

          To learn more, see our tips on writing great answers.




          draft saved


          draft discarded














          StackExchange.ready(
          function ()
          StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f337774%2fdeprecated-options-when-restarting-openssh-in-stretch%23new-answer', 'question_page');

          );

          Post as a guest















          Required, but never shown





















































          Required, but never shown














          Required, but never shown












          Required, but never shown







          Required, but never shown

































          Required, but never shown














          Required, but never shown












          Required, but never shown







          Required, but never shown






          Popular posts from this blog

          Peggy Mitchell

          Palaiologos

          The Forum (Inglewood, California)