helpSavannah Administration - Support: sr #110004, Please publicize the fact the...


sr #110004: Please publicize the fact the ssh-dss keys don't work any more

Submitted by:  Bruno Haible <haible>
Submitted on:  Sat 14 Sep 2019 04:08:02 PM UTC  
Category:  None Priority:  5 - Normal
Severity:  3 - Normal Status:  Done
Assigned to:  Bob Proulx <rwp> Operating System:  GNU/Linux
Open/Closed:  Closed

Add a New Comment (Rich Markup)

You are not logged in

Please log in, so followups can be emailed to you.


Sat 14 Sep 2019 10:52:07 PM UTC, comment #1: 

I am sorry you missed seeing our notifications!  Where should we have sent those notifications so that you would have seen them?

Are you subscribed to the savannah-users mailing list?  That is a low volume mailing list for Savannah users to discuss using Savannah.  Please subscribe if you are not.  I think it is probably the best place to keep up with changes and other happenings.  The deprecation of DSA keys was posted there at the time of the change.

Do you look at the Savannah web home page?  The top news item on the home page is still the deprecation warning of DSA keys.

Savannah has always recommended against using DSA keys due to the weakenesses of them.  Here is the documentation on why they were advised against.  But has previously accepted them anyway.

The upstream OpenSSH project is deprecating DSA keys.  As we upgrade the systems we are simply following their lead and not re-enabling them. "OpenSSH 7.0 and greater similarly disable the ssh-dss (DSA) public key algorithm.  It too is weak and we recommend against its use."

At this moment the cvs system is running a newer version of the OS which includes OpenSSH 7.4p1 while the git system is still running the older OS version with OpenSSH 6.6.1p1 but it will also be upgraded at some point in the near future.

Bob Proulx <rwp>
Site AdministratorIn charge of this item.
Sat 14 Sep 2019 04:08:02 PM UTC, original submission:  

A couple of weeks ago my access to the web pages my savannah projects stopped working: A simple 'cvs log index.html' was asking for the password of, instead of succeeding with the SSH key exchange. Likewise, a fresh checkout of the web pages failed:

$ cvs -z3 co gnulib's password:

At the same time, access to the git source code of the same project continued to work (ssh://

I got the problem fixed by going to 'My Account Configuration > Authentication Setup > SSH Public Keys' and adding a new public key, of type ed25519 or ecdsa. Previously I had only one key, of type dss.

So, what changed is apparently that started to ignore keys of type dss, while continues to accept them.

Probably I'm not the only one with this issue. Therefore it would be good if you could post a news item to appropriate channels, telling people "Attention: If you have a key of type dss registered in your savannah account, it will now be ignored by Register a new key of type ed25519 or ecdsa through Savannah's Account Configuration." This would have saved me 2 hours of searching.

Bruno Haible <haible>


(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:

No files currently attached


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -email is unavailable- added by rwp (Posted a comment)
  • -email is unavailable- added by haible (Submitted the item)

    Do you think this task is very important?
    If so, you can add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.




    Follow 3 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2019-09-14 rwp StatusNone => Done
        Assigned toNone => rwp
        Open/ClosedOpen => Closed

    Back to the top

    Powered by Savane 3.5