Skip site navigation (1)Skip section navigation (2)
Date:      Fri, 2 Dec 2011 15:39:30 -0800
From:      Jeremy Chadwick <freebsd@jdc.parodius.com>
To:        Freddie Cash <fjwcash@gmail.com>
Cc:        stable@freebsd.org
Subject:   Re: r228152: anyone got the None cipher working with base OpenSSH?
Message-ID:  <20111202233930.GA43590@icarus.home.lan>
In-Reply-To: <20111202233220.GA43495@icarus.home.lan>
References:  <CAOjFWZ4W1=TbLuMhi17shuYaNbGq18N1DWYLXiyiJ72gOM_6qA@mail.gmail.com> <20111202233220.GA43495@icarus.home.lan>

next in thread | previous in thread | raw e-mail | index | archive | help
On Fri, Dec 02, 2011 at 03:32:20PM -0800, Jeremy Chadwick wrote:
> There are multiple places where this needs to get defined for it to
> work.

Sorry I should be more clear (I woke up ~15 minutes ago).  I'm referring
to the fact that OpenSSH build points in FreeBSD are ""scattered all
over"", e.g. src/secure/lib/libssh, src/secure/usr.bin/scp,
src/secure/usr.bin/sftp, src/secure/usr.bin/ssh*, etc... You get the
idea.  The above make.conf addition will handle everything.  And yes I
have tested it.

You also need to read README.hpn to understand fully how to get None
cipher to work from the server AND client side, *AND* what the limits
and caveats are.  There are changes you need to make to
/etc/ssh/sshd_config, and there are *multiple* -o switches you will need
to use with the client (e.g. ssh -oCipher=none -oNoneEnabled=yes
-oNoneSwitch=yes).  If the WARNING message that is output to stderr
bothers you, use -T.

Good luck.

-- 
| Jeremy Chadwick                                jdc at parodius.com |
| Parodius Networking                       http://www.parodius.com/ |
| UNIX Systems Administrator                   Mountain View, CA, US |
| Making life hard for others since 1977.               PGP 4BD6C0CB |




Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20111202233930.GA43590>