Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

How can I disable DSA and ECDSA authentication on my server with OpenSSH 5.9? Sifting through the documentation material and doing a web search didn't yield any results - only an old bug report for the Debian package here (and those linked at the bottom of that bug) but no conclusion.

Assuming it is not possible to disable those two methods from inside the /etc/ssh/sshd_config, is it enough to do (Bash syntax): for i in /etc/ssh/ssh_host_{ecdsa,dsa}_key*; do echo -n ""|sudo tee "$i"; sudo chattr +i "$i"; done (below with line breaks for readability):

for i in /etc/ssh/ssh_host_{ecdsa,dsa}_key*;
do
  echo -n ""|sudo tee "$i"
  sudo chattr +i "$i"
done

I.e. to invalidate the host keys and then make them immutable, thus rendering attempts from sshd to regenerate the DSA and ECDSA host keys impossible.

The reason I want to disable DSA is because there are sources that claim weaknesses in the algorithm that have been actively abused, such as Wikipedia and this website. I dug a bit further and it seems credible. The more pragmatic and less theoretical advantage is the verification speed of RSA over DSA.

TL;DR: is it possible to configure sshd from OpenSSH in sshd_config to disable ECDSA and DSA? If not, can one prevent successful authentications with those methods by setting the host key files immutable?

share|improve this question

migrated from serverfault.com Jan 17 '13 at 20:34

This question came from our site for professional system and network administrators.

    
Why do you want this? –  Zoredache Jan 11 '13 at 17:46
    
@Zoredache: because of en.wikipedia.org/wiki/Digital_Signature_Algorithm#Sensitivity ... but it doesn't really matter, does it? ;) –  0xC0000022L Jan 11 '13 at 18:02

2 Answers 2

up vote 8 down vote accepted

I will first dispute your reasons for deactivating DSA and ECDSA:

  • There is no known weakness in either which makes them "more vulnerable" than plain RSA.
  • There has been badly made implementations of DSA or ECDSA; however, there has also been badly made implementations of RSA, and in some case it resulted in RSA key leakage (e.g. Bleichenbacher's attack).
  • While (EC)DSA requires a fresh source of good randomness, (EC)DSA key generation is vastly easier to perform than RSA key generation. Badly generated RSA keys appear to happen a lot in practice. This article includes an interesting quote about Arjen Lenstra (whom I would personally trust much more on security matters than almost everybody else):

He said that other formulas such as Diffie-Hellman and DSA aren't as vulnerable because the duplication of a factor makes a key holder vulnerable only to the person who holds the corresponding certificate. "If you have a collision, you only affect one other person. You can hurt them and they can hurt you, but you haven't made it public to everybody and their mother."

  • If you do not have quality randomness on your server you are doomed anyway.

  • As for performance, DSA signature verification is no more expensive than the Diffie-Hellman key exchange which takes place anyway at the beginning of each connection. We are talking about one millisecond or so here on a basic PC; I suggest making actual measures before declaring some cryptographic algorithms guilty of slowness. And ECDSA will be typically ten times faster than DSA.

That being said, if you are really intent on deactivating (EC)DSA support on your SSH server, I suggest recompiling OpenSSH (starting with the source for the version packaged in your specific OS) after deactivating DSA and ECDSA in it (look for the key.c, function key_verify(): it suffices to modify it so that (EC)DSA verification always fails, and you will never accept any (EC)DSA-based authentication).

(There does not appear to be an option to selectively deactivate support for asymmetric algorithms. Your server will be deemed to implicitly allow DSA if it has a DSA key, which somehow makes sense. As for client authentication, in the SSH model, this is a decision which is up to each user, who decides to include or not include his RSA/DSA/ECDSA public key in his .ssh/authorized_keys. This might be a case for user education, after all.)

share|improve this answer
    
Turns out this isn't true (the last statement). I have even made it impossible for the server to provide the DSA host key (truncated the file and made it immutable), yet I am able to log in. Thanks anyway for the cross-referenced answer and a +1. –  0xC0000022L Jan 21 '13 at 12:22
1  
Note that OpenSSH key generation nowadays caps DSA keys at 1024 bits, for strict RFC compliance and better interop with some other implementations, so without patching ssh-keygen you can't generate a DSA key of a length appropriate for modern use. Thus use RSA and ECDSA, but avoid DSA. –  Phil P Nov 7 '13 at 15:09
    
I'm wondering whether your assessment from the first paragraph still stands: DSA being safe and all. Just wondering, since my question is from before Snowden's leaks. –  0xC0000022L May 5 at 10:04

It looks like there's an option that is legal for sshd_config:

DSAAuthentication no

does half of what you're looking for. I don't know if there's an equivalent for ECDSA. I found that option here.

share|improve this answer
    
Weird, this appears to be a new directive then. It's not in the version of man sshd_config I have. But thanks, appears there is a newer version that will have it. I looked for Dsa, DSA and dsa in the man page. +1 as this seems to be version-specific and clearly your answer would work would I have the "correct" version. –  0xC0000022L Jan 11 '13 at 18:05
1  
openssh.com/txt/release-2.5.1p1 - DSAAuthentication is obsolete. –  Zoredache Jan 11 '13 at 18:32
    
@Zoredache: so it's actually old, not new. Dang ... –  0xC0000022L Jan 11 '13 at 21:33
    
Yeah, I realized after I left that the reason it wasn't in the current man page is because it's deprecated. Thanks for catching that Zoredache. –  Max Sherman Jan 12 '13 at 0:08
    
DSAAuthentication is an alias for PubkeyAuthentication, so disabling it also disables RSA. –  Phil P Nov 7 '13 at 15:07

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.