Does this affect mosh?
No, the roaming in Mosh is unrelated to OpenSSH's roaming feature.
Doesn't mosh initially establish a connection via SSH, though?
OpenSSH: client bug CVE-2016-0777
51–60 of 226 posts
Re: OpenSSH: client bug CVE-2016-0777
#52Does this affect mosh?
Yes; mosh depends on ssh to set up the connection (auth and initial key exchange).
Re: OpenSSH: client bug CVE-2016-0777
#53Does this affect mosh?
No, the roaming in Mosh is unrelated to OpenSSH's roaming feature.
But Mosh uses OpenSSH for authentication. And if roaming is enabled by default on the client this could still be an issue, no? I'd say it's still a good idea to add "UseRoaming no" to ssh_config.
Re: OpenSSH: client bug CVE-2016-0777
#54Does this affect mosh?
No, the roaming in Mosh is unrelated to OpenSSH's roaming feature.
But authentication in Mosh still relies on OpenSSH, so auth could be intercepted by an attacker after which Mosh is completely open to them:
> However, in typical usage, Mosh relies on SSH to exchange keys at the beginning of a session, so Mosh will inherit the weaknesses of SSH—at least insofar as they affect the brief SSH session that is used to set up a long-running Mosh session.
Re: OpenSSH: client bug CVE-2016-0777
#55Does this affect mosh?
No, the roaming in Mosh is unrelated to OpenSSH's roaming feature.
Right, but mosh uses ssh for initial key setup. I suspect it is possible to exploit that. (As an occasional Windows user who's using the Mosh Chrome extension, I have no idea how much risk I'm at; can't edit ssh_config, it's not even exposed)
Re: OpenSSH: client bug CVE-2016-0777
#56Re: OpenSSH: client bug CVE-2016-0777
#57Workaround (yes, it's client-side): # echo -e "Host *\n\tUseRoaming no\n" >> /etc/ssh/ssh_config Disclaimer: won't work on all operating systems, shells, etc. YMMV. Consult a doctor before following any advice you get from the Internet. Void where prohibited. Restrictions may apply. Edited per comments below
Don't ever fix your `ssh_config` by appending stuff to the end of the file. The configuration syntax allows for block constructs without an explicit end marker (like `Match` and `Host`). Appending will cause all kinds of sadness.
It's from the linked page.
Re: OpenSSH: client bug CVE-2016-0777
#58Earlier quoted context omitted.
It affects all operating systems: http://marc.info/?l=openbsd-tech&m=145278077820529&w=2
Is there any way to update openssh on my side, without waiting to apple ? Is this enough ? https://mochtu.de/2015/01/07/updating-openssh-on-mac-os-x-10...
Even easier, just place this text:
UseRoaming no
Doing that will only protect you in that OS X user account, but I bet you only ever use one account on your Mac to SSH anyway.
Re: OpenSSH: client bug CVE-2016-0777
#59Earlier quoted context omitted.
Don't ever fix your `ssh_config` by appending stuff to the end of the file. The configuration syntax allows for block constructs without an explicit end marker (like `Match` and `Host`). Appending will cause all kinds of sadness.
It's from the linked page.
Indeed. The page gives bad advise. If your config has `Host` blocks, like often in people's personal configs, or if you have a `Match` block, the new directive only applies to the last of those blocks in the config file.
Re: OpenSSH: client bug CVE-2016-0777
#60Earlier quoted context omitted.
What's more, it was not documented in the ssh_config(5) man page. If it had been, I probably would have disabled it long ago when hardening my SSH config. Time to head to the source to look for other undocumented options... Update: my findings are here (scroll to bottom for the upshot): https://gist.github.com/AGWA/e92d4f5343be1f7a941d UseRoaming is the only one to be concerned about. There are many other undocumente…
https://github.com/openssh/openssh-portable/blob/e6c85f8889c... Here you go
Actually, I quickly generated a list of undocumented config options: http://sprunge.us/QDSE
Edit: Fixed version http://sprunge.us/LVYB