Ssh – Deprecated options when restarting openssh in Stretch

debianopenssh

Today, after doing updates in Debian Stretch, it started displaying these warnings when restarting the ssh service with my current config:

/etc/ssh/sshd_config line 17: Deprecated option KeyRegenerationInterval
/etc/ssh/sshd_config line 18: Deprecated option ServerKeyBits
/etc/ssh/sshd_config line 29: Deprecated option RSAAuthentication
/etc/ssh/sshd_config line 36: Deprecated option RhostsRSAAuthentication
[....] Restarting OpenBSD Secure Shell server: sshd
/etc/ssh/sshd_config line 17: Deprecated option KeyRegenerationInterval
/etc/ssh/sshd_config line 18: Deprecated option ServerKeyBits
/etc/ssh/sshd_config line 29: Deprecated option RSAAuthentication
/etc/ssh/sshd_config line 36: Deprecated option RhostsRSAAuthentication

What is happening here?

Using Debian 9 with OpenSSH 7.4

Best Answer

In the current Stretch update, openssh version changed from 7.3 to 7.4, released on 2016-Dec-19.

As it can be inferred from the Release notes, and from @Jakuje comments, OpenSSH maintainers have removed the corresponding configuration options for good, as they are obsolete.

So the lines can be safely removed.

Also, take head of:

Future deprecation notice

We plan on retiring more legacy cryptography in future releases, specifically:

  • In approximately August 2017, removing remaining support for the
    SSH v.1 protocol (client-only and currently compile-time disabled).

  • In the same release, removing support for Blowfish and RC4 ciphers and the RIPE-MD160 HMAC. (These are currently run-time disabled).

  • Refusing all RSA keys smaller than 1024 bits (the current minimum
    is 768 bits)

  • The next release of OpenSSH will remove support for running sshd(8) with privilege separation disabled.

  • The next release of portable OpenSSH will remove support for
    OpenSSL version prior to 1.0.1.

Related Question