OpenSSH: client bug CVE-2016-0777

Post by aexaey » Thu, Jan 14, 2016, 7:52 PM UTC

Xylakant wrote: post #167

aexaey wrote: post #163

Earlier quoted context omitted.

If you have clean network path from your terminal to the dev vm, why need for either ProxyCommand or ForwardAgent - just ssh to the vm directly, no? Of course local, not forwarded ssh-agent on the terminal would be super-handy to avoid typing pass-phrase time and again; but that's different and independent from ForwardAgent.

I do ssh directly to the VM. It sits behind a VPN connection at aws. I need to make ssh connections from there to github. The key resides on a smartcard in my laptops usb slot. And that's where ssh-agent/ForwardAgent comes into play. I forward my local key to the remote VM.

Post by larrymcp » Thu, Jan 14, 2016, 8:09 PM UTC

jlgaddis wrote: post #73

drzaiusapelord wrote: post #67

Earlier quoted context omitted.

It just sounds like a big code-base fuckup. They more or less admit it: "Server side was disabled/gutted for years already, but this aspect was surprisingly forgotten." Sounds like this was put in at one time, forgotten about, and the code lingered for a long time until someone pointed it out. SSH as a protocol is pretty crazy. Everyone loves it, but its a lot of things in one, which ironically goes against the unix…

Pretty sure this is OpenSSH only. PuTTY and SecureCRT, at least, are reported not to be affected.

Post by nulltype » Thu, Jan 14, 2016, 8:18 PM UTC

antoinealb wrote: post #180

lftl wrote: post #169

Earlier quoted context omitted.

Interestingly I haven't been able to get the Roaming not allowed message to show on my client with or without the config option set.

Did you copy the whole line as "g ssh -v -T git@github.com 2>&1 | grep "Roaming debug1: Roaming not allowed by server"" ? I misread GP's command and made that mistake. The correct command is : ssh -v -T git@github.com 2>&1 | grep "Roaming"

Post by lftl » Thu, Jan 14, 2016, 8:22 PM UTC

antoinealb wrote: post #180

lftl wrote: post #169

Earlier quoted context omitted.

Interestingly I haven't been able to get the Roaming not allowed message to show on my client with or without the config option set.

Did you copy the whole line as "g ssh -v -T git@github.com 2>&1 | grep "Roaming debug1: Roaming not allowed by server"" ? I misread GP's command and made that mistake. The correct command is : ssh -v -T git@github.com 2>&1 | grep "Roaming"

Post by the_mitsuhiko » Thu, Jan 14, 2016, 8:40 PM UTC

tobiasu wrote: post #161

ygjb-dupe wrote: post #152

While the bug doesn't expose a user to mitm attacks in general, am I correct in thinking that folks using "-o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no" have basically opened the door for that? https://github.com/search?q=-o+UserKnownHostsFile%3D%2Fdev%2...

Ughhh, that's insane.