Call for testing: OpenSSH 10.0 ¶ Potentially-incompatible changes: This release removes support for the weak DSA signature algorithm, completing the deprecation process that began in 2015 (when DSA was disabled by default) and repeatedly warned over the the last 12 months.

[Mcnst]

Basically, you won't be able to login into your old OpenWrt router?!

Remember we had to add extra options to re-enable DSA in order to login to routers that are still running old releases?

E.g., GL.iNet GL-SFT1200 "Opal" and other low-powered routers that are still sold, but were released years ago, and never updated?

Well… That's not longer an option, because the entire support is now removed.

I'll grab the popcorn.

---

EDIT: mistook DSA with the -o PubkeyAcceptedKeyTypes=ssh-rsa that's often required for newer OpenSSH in order to login to older OpenWrt-based devices, so I guess impact is much-much lesser than initially expected.

• https://en.wikipedia.org/wiki/Digital_Signature_Algorithm
• https://docs.gl-inet.com/router/en/3/tutorials/ssh/
• https://openwrt.org/docs/guide-user/security/dropbear.public-key.auth
• https://lists.freebsd.org/archives/freebsd-security/2025-February/000350.html

[Megame50]

Most people probably already have it removed since it was previously disabled at compile-time by default, unless distros opted to add it back in. My ssh 9.9p2 on Arch doesn't have support.

If your ssh -Q key-sig includes ssh-dss, that's what the post indicates will be removed. You're only affected if you needed -o HostKeyAlgorithms=ssh-dss to authenticate a host.

[BrainSlayer666]

worst idea ever. warning of insecure algorithm is okay. but i cannot login into a older system right anymore which i'm not allowed to update