Deprecate DSA/DSS support about dropbear

[mkj]

It should already be compiled out by default?

[riobard]

Tested on dropbear version v2022.83 on Alpine Linux 3.19 and only kex algo got rid of DSS. Host key algo still contains ssh-dss if the host key file /etc/dropbear/dropbear_dss_host_key exists (which Alpine init.d script conveniently generates if missing).

Should it be removed more thoroughly?

Results running nmap --script ssh2-enum-algos -sV -p 22 [target host]

PORT   STATE SERVICE VERSION
22/tcp open  ssh     Dropbear sshd 2022.83 (protocol 2.0)
| ssh2-enum-algos: 
|   kex_algorithms: (9)
|       curve25519-sha256
|       [email protected]
|       ecdh-sha2-nistp521
|       ecdh-sha2-nistp384
|       ecdh-sha2-nistp256
|       diffie-hellman-group14-sha256
|       diffie-hellman-group14-sha1
|       [email protected]
|       [email protected]
|   server_host_key_algorithms: (5)
|       ssh-ed25519
|       ecdsa-sha2-nistp256
|       rsa-sha2-256
|       ssh-rsa
|       ssh-dss
|   encryption_algorithms: (3)
|       [email protected]
|       aes128-ctr
|       aes256-ctr
|   mac_algorithms: (2)
|       hmac-sha1
|       hmac-sha2-256
|   compression_algorithms: (2)
|       [email protected]
|_      none
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

[mkj]

The fix hasn't made it to a release yet.
c043efb

[riobard]

Sorry my bad, didn't notice that. OTOH are we expecting a release anytime soon? Latest release is more than a year old.

[mkj]

Yeah, just have a few PRs that I want to get merged first.