OpenSSH 6.8 released

#1

Post by mukyu » Wed, Mar 18, 2015, 2:11 PM UTC

OpenSSH 6.8 released
lists.mindrot.org

Re: OpenSSH 6.8 released

#2

Post by an6n » Wed, Mar 18, 2015, 3:02 PM UTC

I was hoping for U2F but I guess it's not ready yet. :)

Re: OpenSSH 6.8 released

#3

Post by some_furry » Wed, Mar 18, 2015, 3:05 PM UTC

The --without-openssl option is particularly attractive on Linux systems if you distrust openssl's code.

Re: OpenSSH 6.8 released

#4

Post by forgottenpass » Wed, Mar 18, 2015, 3:23 PM UTC

an6n wrote: post #2

I was hoping for U2F but I guess it's not ready yet. :)

Wouldn't that be more in the scope of PAM than an SSHd?

Edit: https://github.com/Yubico/pam-u2f

Re: OpenSSH 6.8 released

#5

Post by xorcist » Wed, Mar 18, 2015, 3:28 PM UTC

some_furry wrote: post #3

The --without-openssl option is particularly attractive on Linux systems if you distrust openssl's code.

It is, but please note that OpenSSH uses very little of OpenSSL's code. None of the serious bugs lately had any impact on OpenSSH.

Re: OpenSSH 6.8 released

#6

Post by skrowl » Wed, Mar 18, 2015, 3:30 PM UTC

some_furry wrote: post #3

The --without-openssl option is particularly attractive on Linux systems if you distrust openssl's code.

What functionality do you lose if you build it with that option?

Re: OpenSSH 6.8 released

#7

Post by some_furry » Wed, Mar 18, 2015, 3:31 PM UTC

skrowl wrote: post #6

some_furry wrote: post #3

The --without-openssl option is particularly attractive on Linux systems if you distrust openssl's code.

What functionality do you lose if you build it with that option?

From the article:

    Disables and removes dependency on OpenSSL. Many features,
    including SSH protocol 1 are not supported and the set of crypto
    options is greatly restricted. This will only work on systems
    with native arc4random or /dev/urandom.

I haven't dug into the source code, but I'd wager that the crypto options that remain are Ed25519, ChaCha20-Poly1305, etc. (Don't quote me on this, however.)

Re: OpenSSH 6.8 released

#8

Post by some_furry » Wed, Mar 18, 2015, 3:41 PM UTC

xorcist wrote: post #5

some_furry wrote: post #3

The --without-openssl option is particularly attractive on Linux systems if you distrust openssl's code.

It is, but please note that OpenSSH uses very little of OpenSSL's code. None of the serious bugs lately had any impact on OpenSSH.

That's probably very reassuring.

I personally don't share this belief that openssl is bad (in fact, for PHP developers, openssl is preferable to libmcrypt which has been abandoned since 2007), I just know it's a common sentiment of infosec people. :)

Re: OpenSSH 6.8 released

#9

Post by feld » Wed, Mar 18, 2015, 3:42 PM UTC

an6n wrote: post #2

I was hoping for U2F but I guess it's not ready yet. :)

Chrome has access to USB and its own code to handle U2F devices. This would require your SSH client to have the same capabilities.

This might work well on Linux/BSD machines, but likely not on OSX due to stagnant unix utility updates and Windows because... well, not a real Unix. Would probably require a heavy wrapper around Putty. Not sure if cygwin and friends would ever work either.

Re: OpenSSH 6.8 released

#10

Post by beagle3 » Wed, Mar 18, 2015, 3:47 PM UTC

I submitted a very detailed bug report[0] a while ago, which can lead to a DoS (albeit in a very specific setting). I don't expect anyone to rush to fix it, but I'm surprised that there isn't even a comment about it. Is there another place it needs to be reported in?

[0] https://bugzilla.mindrot.org/show_bug.cgi?id=2265