Hey guys, crypto-noob here.
Who needs this? I have a ssh server on my ubuntu, do I need to update OpenSSH? Also, I have openssl installed (for some reason), is that the same thing?
OpenSSH 7.4 released
31–40 of 43 posts
Re: OpenSSH 7.4 released
#32Earlier quoted context omitted.
It would be if you were using HTTPS Everywhere.
Weird thing is, I am in fact using it... But their server should also redirect normal users. EDIT: ah no, different computers. On my personal computers I have it, not on my workplace computer. (and my point remains, they should redirect traffic)
You should use HTTPS Everywhere everywhere.
Re: OpenSSH 7.4 released
#33Earlier quoted context omitted.
Why would a containerized system not need it? Defense in depth would be a good thing.
Because Docker isn't running as root to begin with; it just convinces the containerized process that it is.
You've just demonstrated that you don't understand either the goals or mechanism of privilege separation: 1) it doesn't require root and 2) it protects more than the root account.
Re: OpenSSH 7.4 released
#34Hey guys, crypto-noob here. Who needs this? I have a ssh server on my ubuntu, do I need to update OpenSSH? Also, I have openssl installed (for some reason), is that the same thing?
The ssh server on your Ubuntu machine is probably OpenSSH. If you're keeping your machine up to date with Ubuntu's security updates then you can let them take care of it.
OpenSSL is separate software, but it provides a cryptography library that OpenSSH (usually) uses. You will need it installed.
Re: OpenSSH 7.4 released
#35Hey guys, crypto-noob here. Who needs this? I have a ssh server on my ubuntu, do I need to update OpenSSH? Also, I have openssl installed (for some reason), is that the same thing?
The ssh server on your Ubuntu machine is probably OpenSSH. If you're keeping your machine up to date with Ubuntu's security updates then you can let them take care of it. OpenSSL is separate software, but it provides a cryptography library that OpenSSH (usually) uses. You will need it installed.
It's unfortunate timing that just today I got the message that I could no long get updates for Ubuntu 15, and pressing me to update to Ubuntu 16
Re: OpenSSH 7.4 released
#36Earlier quoted context omitted.
The ssh server on your Ubuntu machine is probably OpenSSH. If you're keeping your machine up to date with Ubuntu's security updates then you can let them take care of it. OpenSSL is separate software, but it provides a cryptography library that OpenSSH (usually) uses. You will need it installed.
It's unfortunate timing that just today I got the message that I could no long get updates for Ubuntu 15, and pressing me to update to Ubuntu 16
Research about Ubuntu (or any distribution) long term releases (LTS) to avoid that situation in the future :)
Re: OpenSSH 7.4 released
#37Earlier quoted context omitted.
Why would a containerized system not need it? Defense in depth would be a good thing.
Because Docker isn't running as root to begin with; it just convinces the containerized process that it is.
Aren't those the "unprivileged containers" that keep showing up as having huge security vulnerabilities?
Re: OpenSSH 7.4 released
#38Earlier quoted context omitted.
It's unfortunate timing that just today I got the message that I could no long get updates for Ubuntu 15, and pressing me to update to Ubuntu 16
Research about Ubuntu (or any distribution) long term releases (LTS) to avoid that situation in the future :)
TY
Re: OpenSSH 7.4 released
#39Openssh is one of the pieces of software that I would argue needs to be kept up to the latest and greatest regardless of the original version shipped by the distro. I would similarly push for latest version of OpenSSL but that's harder to get right.
Right now distros who backport, such as Debian, need to very carefully read changelogs and decide what and what not to backport. Quite a daunting task.
I get that. My argument is for a small subset of software tools, to be considered to be sufficiently critical that updates are prioritized because compromise of said tools would have outsized consequences.
Re: OpenSSH 7.4 released
#40Hm. That's more mechanism-as-policy than I like, e.g. : Refusing all RSA keys smaller than 1024 bits The next release of OpenSSH will remove support for running sshd(8) with privilege separation disabled That's not really the sort of decision application programmers should be making for sysadmins.
What's your argument for keeping it in? I mean, what specific scenario do you need to account for where this is a must have?