Bug#991130: Manpage: CASignatureAlgorithms mentions a wrong default
Package: openssh-server
Version: 1:7.9p1-10+deb10u2
Severity: normal
Dear Maintainer,
on a current unreleased Debian bullseye (openssh-server 1:8.4p1-5)
the sshd_config(5) mentions the CASignatureAlgorithms
with a wrong default:
| CASignatureAlgorithms
| Specifies which algorithms are allowed for signing of certifi-
| cates by certificate authorities (CAs). The default is:
|
| ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
| ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa
|
| Certificates signed using other algorithms will not be accepted
| for public key or host-based authentication.
The ssh-rsa algorithm is not in the default set of algorithms, as it
seems (tested with the above server version, after setting the
CASignatureAlgorithms options to the (mistakenly documented default),
SSH certificates with RSA signatures worked again.
This should be clearly stated in this section.
Reply to: