Date: Mon, 20 Oct 2014 18:33:40 +0000 From: Brooks Davis <brooks@freebsd.org> To: Allan Jude <allanjude@freebsd.org> Cc: freebsd-current@freebsd.org Subject: Re: ssh None cipher Message-ID: <20141020183340.GC94319@spindle.one-eyed-alien.net> In-Reply-To: <5441E834.2000906@freebsd.org> References: <CAOc73CCvQqwg65tt9vs54CoU1HGvV7ZxLWeQwXiSOm8UjtV50w@mail.gmail.com> <alpine.GSO.1.10.1410172242240.27826@multics.mit.edu> <5441E834.2000906@freebsd.org>
next in thread | previous in thread | raw e-mail | index | archive | help
--pvezYHf7grwyp3Bc Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Sat, Oct 18, 2014 at 12:10:28AM -0400, Allan Jude wrote: > On 2014-10-17 22:43, Benjamin Kaduk wrote: > > On Fri, 17 Oct 2014, Ben Woods wrote: > >=20 > >> Whilst trying to replicate data from my FreeNAS to my FreeBSD home the= ater > >> PC on my local LAN, I came across this bug preventing use of the None > >> cipher: > >> https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D163127 > >> > >> I think I could enable the None cipher by recompiling base with a flag= in > >> /etc/src.conf. > >=20 > > I agree. > >=20 > >> Is there any harm in enabling this by default, but having the None cip= her > >> remain disabled in /etc/ssh/sshd_config? That way people wouldn't have= it > >> on my default, but wouldn't have to recompile to enable it. > >=20 > > I do not see any immediate and concrete harm that doing so would cause, > > yet that is insufficient for me to think that doing so would be a good > > idea. >=20 > I've been using openssh-portable from ports with the none cipher patch > to get around this. >=20 > IIRC, upstream openssh refuses to merge the none cipher patches "because > you shouldn't do that". But I'd vote for having it compiled in and just > disabled by default. >=20 > It will refuse to let you have a shell without encryption, and prints a > big fat hairy warning when encryption is disabled. When Bjoern and I did the merge of the HPN patches we left None disable by default out of a desire to be conservative with a change we knew some people didn't like. I think turning it on by default would be fine given the seatbelts in place to prevent accidental inappropriate use. -- Brooks --pvezYHf7grwyp3Bc Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iEYEARECAAYFAlRFVYMACgkQXY6L6fI4GtSxygCgsjY+w69Ao0gcA6Ku5uhL/UvF aLUAoJGBDMSx6LpXYuKM7sLVHtmVOb0t =9tAH -----END PGP SIGNATURE----- --pvezYHf7grwyp3Bc--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20141020183340.GC94319>