OpenSSH 6.8 released • Hacker News Board

Re: OpenSSH 6.8 released

#21

Post by dwb » Wed, Mar 18, 2015, 4:50 PM UTC

https://bugzilla.mindrot.org/show_bug.cgi?id=1424 :(

Oh well, refactoring and crypto work is certainly more important. Congrats on the release.

Re: OpenSSH 6.8 released

#22

Post by SpaceInvader » Wed, Mar 18, 2015, 5:26 PM UTC

Finally UseDNS is set to 'no' by default. This is the thing I was ALWAYS changing :)

Re: OpenSSH 6.8 released

#23

Post by some_furry » Wed, Mar 18, 2015, 5:30 PM UTC

jamiesonbecker wrote: post #16

some_furry wrote: post #8

Earlier quoted context omitted.

That's probably very reassuring. I personally don't share this belief that openssl is bad (in fact, for PHP developers, openssl is preferable to libmcrypt which has been abandoned since 2007), I just know it's a common sentiment of infosec people. :)

Just because OpenSSL is very hard to replace doesn't mean it's not very bad.

Sure. I simply use it for crypto primitives (e.g. aes-256-gcm) in environments where I cannot install libsodium from PECL (e.g. crypto_easybox() and crypto_easybox_open()).

Re: OpenSSH 6.8 released

#24

Post by citrin_ru » Wed, Mar 18, 2015, 5:38 PM UTC

some_furry wrote: post #3

The --without-openssl option is particularly attractive on Linux systems if you distrust openssl's code.

It is also useful for embedded devices with small flash/ROM.

Re: OpenSSH 6.8 released

#25

Post by Gracana » Wed, Mar 18, 2015, 5:49 PM UTC

throwaway7767 wrote: post #12

The host key rotation support sounds very nice, and something I've wanted for a long time: > * ssh(1), sshd(8): Experimental host key rotation support. Add a protocol extension for a server to inform a client of all its available host keys after authentication has completed. The client may record the keys in known_hosts, allowing it to upgrade to better host key algorithms and a server to gracefully rotate its keys.…

But you don't want users to think they're normal and should be ignored. They're an exceptional case and should be understood.

Re: OpenSSH 6.8 released

#26

Post by secure » Wed, Mar 18, 2015, 6:14 PM UTC

an6n wrote: post #2

I was hoping for U2F but I guess it's not ready yet. :)

Track https://bugzilla.mindrot.org/show_bug.cgi?id=2319

I worked on this for a while, but lost motivation because of the slow development speed. If you’re more motivated, you’re very welcome to pick up where I left and bring this to thousends of users :).

Re: OpenSSH 6.8 released

#27

Post by mortenlarsen » Wed, Mar 18, 2015, 6:15 PM UTC

w8rbt wrote: post #17

The sshlog (password logging) patch still seems to work on 6.8 http://w8rbt.org/patches/sshlog.patch

wget is blocked on that URL, any specific reason?

wget --user-agent="Not wget" http://w8rbt.org/patches/sshlog.patch

works.

Re: OpenSSH 6.8 released

#28

Post by hobarrera » Wed, Mar 18, 2015, 6:21 PM UTC

> [...] SSH protocol version 1.3, 1.5 [...]

Do we still need these? Aren't they extremely ancient? Is there any old client that only support these protocol versions and has no security issues, or is out-of-support?

Re: OpenSSH 6.8 released

#29

Post by Florin_Andrei » Wed, Mar 18, 2015, 6:33 PM UTC

SpaceInvader wrote: post #22

Finally UseDNS is set to 'no' by default. This is the thing I was ALWAYS changing :)

I always felt guilty about it, as if I was perhaps missing something obvious. :)

Glad to see it gone in the defaults.

Re: OpenSSH 6.8 released

#30

Post by themckman » Wed, Mar 18, 2015, 7:52 PM UTC

OpenSSH is certainly the standard amongst SSH servers, however, I'm curious if there are serious alternatives that offer something missing in OpenSSH? I know there's a patch floating around that allowed some buffer to be configurable and boosted `scp` performance, for example, but I'm curious if there are other servers that offer anything else interesting.