Date: Sat, 26 Oct 2002 14:07:26 -0700 From: David Schultz <dschultz@uclink.Berkeley.EDU> To: Tim Kientzle <kientzle@acm.org> Cc: current@FreeBSD.ORG Subject: Re: Request: remove ssh1 fallback Message-ID: <20021026210726.GB5889@HAL9000.homeunix.com> In-Reply-To: <3DB834C3.8010601@acm.org> References: <bulk.29405.20021024004250@hub.freebsd.org> <3DB834C3.8010601@acm.org>
next in thread | previous in thread | raw e-mail | index | archive | help
Thus spake Tim Kientzle <kientzle@acm.org>: > Thus spake Lucky Green <shamrock@cypherpunks.to>: > >>... remove ssh1 fallback from the default ... > > David Schultz <dschultz@uclink.Berkeley.EDU> wrote: > >Removing SSH 1 ... is going to break compatibility ... > > > POLA: before breaking compatibility, warn people. > It's simple to modify the ssh client so that it > emits a warning message before downgrading > > "Warning: switching to less-secure SSH1 protocol" > > On the server side, you could certainly log > a warning; there may be a way to notify the > connecting user as well. The logged warning > could even include a very brief reference to > the setting required to disable SSH1 entirely. I think you're missing the point. Warnings are fine, but there is little good reason to disable SSH1 entirely. If one end of the connection is forced to fall back to SSH1, it's almost certainly because the user at the other end _doesn't_have_any_other_option_. You're proposing to kick legitimate users off of everyone's FreeBSD boxen because you know better than they do about security. I know SSH1 is insecure, and therefore I don't use it. But I'm not about to unleash a surprise on everyone who uses a machine without SSH2 just so I can hammer the idea into their heads. Breaking POLA isn't a sin, but you'd better have a better reason to do it than ``it lets people do things that are insecure.'' So do rsh, telnet, hosts.equiv, vipw, et al. To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-current" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20021026210726.GB5889>