+example paragraph for ssh-rsa connections

1 files changed, 10 insertions, 0 deletions

diff --git a/.ssh/config.d/0000-all.conf b/.ssh/config.d/0000-all.conf
index 54a6137..b19eca4 100644
--- a/.ssh/config.d/0000-all.conf
+++ b/.ssh/config.d/0000-all.conf
@@ -14,3 +14,13 @@ ControlPath		/run/user/%i/ssh/cm-%r@%h:%p
 #	Hostname b.example.com
 #	ProxyCommand ssh a.example.com -W %h:%p
 #	# controlpath, controlmaster are the same as above
+# 
+# For older SSH daemons: RSA SHA-1 is being quickly deprecated across OSes for various security
+# vulnerabilities. If you need to re-enable that (e.g. for hardware like network devices which are
+# often prone to vulnerabilities due to slow upgrading), you can re-enable this and you SHOULD do
+# this ONLY for specific hosts. (Yes, this ofc also affects clients - which it did on an Arch Linux here.)
+# Also see https://www.openssh.com/txt/release-8.2
+# If you have a proper naming convention for your devices, you can still easily wildcard this. If you
+# don't, you either don't have many devices or you moronically did not think device names through. ;-)
+# Host sophos* *-mik-*
+# 	PubkeyAcceptedKeyTypes +ssh-rsa