OpenSSH 6.8 released • Hacker News Board

Re: OpenSSH 6.8 released

#41

Post by LukeShu » Thu, Mar 19, 2015, 1:11 AM UTC

beagle3 wrote: post #10

I submitted a very detailed bug report[0] a while ago, which can lead to a DoS (albeit in a very specific setting). I don't expect anyone to rush to fix it, but I'm surprised that there isn't even a comment about it. Is there another place it needs to be reported in? [0] https://bugzilla.mindrot.org/show_bug.cgi?id=2265

Try pointing it out on the mailing list ( openssh-unix-dev@mindrot.org ).

Having been on both user and the developer sides, with F/OSS projects, more developers are likely to read every post on the mailing list than every report in the bug tracker.

Re: OpenSSH 6.8 released

#42

Post by throwaway7767 » Thu, Mar 19, 2015, 1:11 PM UTC

Gracana wrote: post #25

throwaway7767 wrote: post #12

The host key rotation support sounds very nice, and something I've wanted for a long time: > * ssh(1), sshd(8): Experimental host key rotation support. Add a protocol extension for a server to inform a client of all its available host keys after authentication has completed. The client may record the keys in known_hosts, allowing it to upgrade to better host key algorithms and a server to gracefully rotate its keys.…

But you don't want users to think they're normal and should be ignored. They're an exceptional case and should be understood.

I think you should read the message you are responding to again, as you just agreed with what I said.

Re: OpenSSH 6.8 released

#43

Post by hobarrera » Thu, Mar 19, 2015, 7:59 PM UTC

Sanddancer wrote: post #33

hobarrera wrote: post #28

> [...] SSH protocol version 1.3, 1.5 [...] Do we still need these? Aren't they extremely ancient? Is there any old client that only support these protocol versions and has no security issues, or is out-of-support?

I've got a few older Dell switches that still work wonderfully, but only connect via ssh1, not ssh2. They're still useful, and setting up a management vlan isn't that hard, so replacing them is a proposition that's much more expensive than it's worth.

That sort of avoids the question: Do those machines still get an up-to-date OpenSSH that's considered trustworthy today? Is there some impediment to upgrade OpenSSH on them?

Re: OpenSSH 6.8 released

#44

Post by wolf550e » Fri, Mar 20, 2015, 9:13 PM UTC

nuclear_eclipse wrote: post #40

wolf550e wrote: post #36

I have to configure ssh servers so that putty is able to connect, so I can't follow best practices. Why don't the people working in this area help the putty project with support for the latest stuff?

What best practices would prevent Putty from connecting? Afaik, I'm using most best practices on my own server, and I can connect with Putty just fine.

AFAIK, Ed25519 keys and Curve25519 key exchange, AES GCM symmetric encryption.