Change SSH defaults to non-SHA-1 by 16.04

[Joey Stanford]

For Security reasons, the Ubuntu Distro should change SSH defaults to use non-SHA-1 by 16.04. That is, to default to SHA2 and, ideally, not permit SHA1. This may break bzr+ssh on LP if done before https://bugs.launchpad.net/launchpad/+bug/1445619

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Seth Arnold (seth-arnold)]

While this might initially seem like prematurely early to end support for SHA-1, it's the tail end of 16.04 LTS's support window that worries me -- I suspect SHA-1 will feel less safe by 2021, but removing support for it in an LTS release feels like the wrong approach.

We may also wish to consider what the server accepts and what the client accepts separately if there's some class of devices that force using SHA-1 in the meantime.

Thanks

[Colin Watson (cjwatson)]

This is done in OpenSSH 7.0, but I plan to hold off on that for at least a while to see if we can get Twisted Conch beaten into shape to support SHA-2; the idea of spending months supporting people having to cope with configuration changes from the default Ubuntu installation in order to access Launchpad Bazaar/Git does not appeal ...