When we compile dropbear (with or without a savedconfig) with DROPBEAR_DSS set to 0, the DSS algorithm is still enabled. The main reason is upstream (as it is enforced in sysoptions.h to make Fuzzing happy as far as I understood). However, the init.d/dropbear script relies on the output of "dropbearkey -h" to detect available algorithms and generates a key for each of them. A solution is to avoid to rely on the dropbearkey output and have a variable in conf.d/dropbear to list algorithms... or, better, just let the admin generate the keys he wants to support without letting the script decide. upstream don't want to fix that as their proposed solution is to just no create a dss key file. Reproducible: Always
(In reply to fariouche from comment #0) > [...] > upstream don't want to fix that as their proposed solution is to just no > create a dss key file. Do you have a source/reference for this, just for completeness?
There is also a related PR ( https://github.com/gentoo/gentoo/pull/36489 ), maybe instead of adding ed25519 we could move all of them in conf.d and disable dss by default.
It seems like since 2024.84, dropbear fixed that. From the release note: Don't unconditionally enable DROPBEAR_DSS https://github.com/mkj/dropbear/releases Confirmed by running 2024.85 latest version in portage, dropbear -h do not report DSS now anymore.
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=c52263280244bbcc756012c3bef6b3f3aa5f7d90 commit c52263280244bbcc756012c3bef6b3f3aa5f7d90 Author: Viorel Munteanu <ceamac@gentoo.org> AuthorDate: 2024-08-27 18:18:26 +0000 Commit: Viorel Munteanu <ceamac@gentoo.org> CommitDate: 2024-08-27 18:18:26 +0000 net-misc/dropbear: disable generating the dss key Bug: https://bugs.gentoo.org/931505 Signed-off-by: Viorel Munteanu <ceamac@gentoo.org> .../dropbear/{dropbear-2022.83.ebuild => dropbear-2022.83-r1.ebuild} | 2 +- .../dropbear/{dropbear-2024.85.ebuild => dropbear-2024.85-r1.ebuild} | 0 net-misc/dropbear/files/dropbear.init.d | 2 +- 3 files changed, 2 insertions(+), 2 deletions(-)
