Bug 400340 - Deprecate/remove DSS used for sftp
Summary: Deprecate/remove DSS used for sftp
Status: RESOLVED WORKSFORME
Alias: None
Product: kdeconnect
Classification: Applications
Component: android-application (show other bugs)
Version: unspecified
Platform: Android Linux
: NOR normal
Target Milestone: ---
Assignee: Albert Vaca Cintora
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2018-10-26 13:59 UTC by rugk
Modified: 2023-01-01 05:20 UTC (History)
1 user (show)

See Also:
Latest Commit:
Version Fixed In:
Sentry Crash Report:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description rugk 2018-10-26 13:59:49 UTC
DSS certs have been deprecated in OpenSSH in 2015(!). With reason, obviously!

As such it is more than time to move away.

Things you may do:
* show an error/warning when old DSS clients are used and advice the user to upgrade
* remove it entirely in the future

There is no way around it. In the shorter or longer time you have to remove it. At some point of time you really need to show a warning for "insecure connection" ("legacy connection" or so) as to make users aware that some component/device needs to be upgraded.
Of course this requires that RSA support is present in all KDE Connect implementations.

I've heard the last thing is the case for Android Oreo+ devices, so obviously the old ones also need to be supported. As such I assign this to the Android component, but you may thread this as a general request.

Same issue in GSConnect: https://github.com/andyholmes/gnome-shell-extension-gsconnect/issues/267

---

BTW, as you already use TLS the other solution would obviously to switch to FTPS… don't know though why SFTP was chosen in the past.
Comment 1 Rex Dieter 2018-10-26 14:48:12 UTC
As far as I can tell, kdeconnect doesn't implement this itself, it uses fuse ssh.  (if so, this bug is misplaced).
Comment 2 Justin Zobel 2022-12-02 01:22:39 UTC
Thank you for reporting this issue in KDE software. As it has been a while since this issue was reported, can we please ask you to see if you can reproduce the issue with a recent software version?

If you can reproduce the issue, please change the status to "REPORTED" when replying. Thank you!
Comment 3 Bug Janitor Service 2022-12-17 05:14:03 UTC
Dear Bug Submitter,

This bug has been in NEEDSINFO status with no change for at least
15 days. Please provide the requested information as soon as
possible and set the bug status as REPORTED. Due to regular bug
tracker maintenance, if the bug is still in NEEDSINFO status with
no change in 30 days the bug will be closed as RESOLVED > WORKSFORME
due to lack of needed information.

For more information about our bug triaging procedures please read the
wiki located here:
https://community.kde.org/Guidelines_and_HOWTOs/Bug_triaging

If you have already provided the requested information, please
mark the bug as REPORTED so that the KDE team knows that the bug is
ready to be confirmed.

Thank you for helping us make KDE software even better for everyone!
Comment 4 Bug Janitor Service 2023-01-01 05:20:38 UTC
This bug has been in NEEDSINFO status with no change for at least
30 days. The bug is now closed as RESOLVED > WORKSFORME
due to lack of needed information.

For more information about our bug triaging procedures please read the
wiki located here:
https://community.kde.org/Guidelines_and_HOWTOs/Bug_triaging

Thank you for helping us make KDE software even better for everyone!