21–30 of 226 posts
Roaming feature has been in OpennSSH code for a while, but is undocumented: http://superuser.com/a/826734/47771
AFAIK the roaming feature has been disabled on the server side for a while, but mistakenly left enabled on the client.
Earlier quoted context omitted.
It affects all operating systems: http://marc.info/?l=openbsd-tech&m=145278077820529&w=2
Is there any way to update openssh on my side, without waiting to apple ? Is this enough ? https://mochtu.de/2015/01/07/updating-openssh-on-mac-os-x-10...
# echo 'UseRoaming no' >> /etc/ssh/ssh_config
$ echo "UseRoaming no" >> ~/.ssh/configSomeone tweeted this, the roaming code doesn't seem to be very well managed: https://twitter.com/marver/status/687644904575627264 Edit 1: Here's some relevant commits too https://marc.info/?l=openbsd-cvs&m=145278217421101&w=2 Edit 2: This mailing list post seems to discuss the vulnerable feature http://www.gossamer-threads.com/lists/openssh/dev/49018?do=p... Edit 3: Got a better description of actual impact of the bu…
The subsystem was apparently experimentally (hence the undocumented option) introduced 6 years ago and essentially never used, the server support was never implemented: http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/roa...
Workaround (yes, it's client-side): # echo -e "Host *\n\tUseRoaming no\n" >> /etc/ssh/ssh_config Disclaimer: won't work on all operating systems, shells, etc. YMMV. Consult a doctor before following any advice you get from the Internet. Void where prohibited. Restrictions may apply. Edited per comments below
Presumably you would have to connect to a malicious host to be effected? Or perhaps a MITM on your connection to a legit host can exploit you somehow.
Malicious or compromised.
> roaming code in the ssh client could be tricked by a hostile sshd server, potentially leaking key material.
http://ftp.openbsd.org/pub/OpenBSD/patches/5.8/common/010_ss...
Earlier quoted context omitted.
It affects all operating systems: http://marc.info/?l=openbsd-tech&m=145278077820529&w=2
Is there any way to update openssh on my side, without waiting to apple ? Is this enough ? https://mochtu.de/2015/01/07/updating-openssh-on-mac-os-x-10...
Someone tweeted this, the roaming code doesn't seem to be very well managed: https://twitter.com/marver/status/687644904575627264 Edit 1: Here's some relevant commits too https://marc.info/?l=openbsd-cvs&m=145278217421101&w=2 Edit 2: This mailing list post seems to discuss the vulnerable feature http://www.gossamer-threads.com/lists/openssh/dev/49018?do=p... Edit 3: Got a better description of actual impact of the bu…
Presumably you meant CVE-2016-0777 and CVE-2016-0778
Someone tweeted this, the roaming code doesn't seem to be very well managed: https://twitter.com/marver/status/687644904575627264 Edit 1: Here's some relevant commits too https://marc.info/?l=openbsd-cvs&m=145278217421101&w=2 Edit 2: This mailing list post seems to discuss the vulnerable feature http://www.gossamer-threads.com/lists/openssh/dev/49018?do=p... Edit 3: Got a better description of actual impact of the bu…