Date: Mon, 20 Oct 2014 18:23:19 -0400 From: Allan Jude <allanjude@freebsd.org> To: freebsd-current@freebsd.org Subject: Re: ssh None cipher Message-ID: <54458B57.60106@freebsd.org> In-Reply-To: <20141020183340.GC94319@spindle.one-eyed-alien.net> References: <CAOc73CCvQqwg65tt9vs54CoU1HGvV7ZxLWeQwXiSOm8UjtV50w@mail.gmail.com> <alpine.GSO.1.10.1410172242240.27826@multics.mit.edu> <5441E834.2000906@freebsd.org> <20141020183340.GC94319@spindle.one-eyed-alien.net>
next in thread | previous in thread | raw e-mail | index | archive | help
This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --lr9mkxBmurnIWkuvbEUlWA9AET76J5ETL Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: quoted-printable On 2014-10-20 14:33, Brooks Davis wrote: > On Sat, Oct 18, 2014 at 12:10:28AM -0400, Allan Jude wrote: >> On 2014-10-17 22:43, Benjamin Kaduk wrote: >>> On Fri, 17 Oct 2014, Ben Woods wrote: >>> >>>> Whilst trying to replicate data from my FreeNAS to my FreeBSD home t= heater >>>> PC on my local LAN, I came across this bug preventing use of the Non= e >>>> cipher: >>>> https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D163127 >>>> >>>> I think I could enable the None cipher by recompiling base with a fl= ag in >>>> /etc/src.conf. >>> >>> I agree. >>> >>>> Is there any harm in enabling this by default, but having the None c= ipher >>>> remain disabled in /etc/ssh/sshd_config? That way people wouldn't ha= ve it >>>> on my default, but wouldn't have to recompile to enable it. >>> >>> I do not see any immediate and concrete harm that doing so would caus= e, >>> yet that is insufficient for me to think that doing so would be a goo= d >>> idea. >> >> I've been using openssh-portable from ports with the none cipher patch= >> to get around this. >> >> IIRC, upstream openssh refuses to merge the none cipher patches "becau= se >> you shouldn't do that". But I'd vote for having it compiled in and jus= t >> disabled by default. >> >> It will refuse to let you have a shell without encryption, and prints = a >> big fat hairy warning when encryption is disabled. >=20 > When Bjoern and I did the merge of the HPN patches we left None disable= > by default out of a desire to be conservative with a change we knew som= e > people didn't like. I think turning it on by default would be fine giv= en > the seatbelts in place to prevent accidental inappropriate use. >=20 > -- Brooks >=20 +1 to this. --=20 Allan Jude --lr9mkxBmurnIWkuvbEUlWA9AET76J5ETL Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (MingW32) iQIcBAEBAgAGBQJURYtXAAoJEJrBFpNRJZKffG4QAIRhTMFT8f/5nXUL99DGW5Ag 722nBVgof6rALvsePoNo998QTOJ1Wj3dgOJWH8HPg0NcdfNJLHX3hYTUPlLURSKn G+Zjo23WRtjbEIMOE2rrFYRs3R0WTwQcIMQQyt+Xgix+MsPrboUefMQ1M7P7Q880 wTUVLLNKxoZFvszf/if9JDWBpGaskwgvx6ogbdcmq7gAVaR6Xqq3bDHLLb/dWNvm UkKvWbkzLtXVbkGhT6Q1iIvblTDyAZeUqLYiPgMw00ce1KlBW4USPi7tkGJbKav2 LLL3NK7s+L+TBaB5um9pw0t2K0Pyro1a3aLVQskx6JynCQX3R0eJ1GHSCM2weOKi BBpxGO77ZE8q1KAwWzvNF3itbQjy18X7MuysdDTioNBkp6nB1zp809BXL4yHassc bVBTrfOKM/nMcyLPbbDxfGoBRXWASjTZnlKnkB/Di+GUghQdW/4mjUBzWapbPdQu yl1yvrJbjAE3ZsYMjNGssPJYV+ERWHZeIpAXMGvAsszTlFYimgNNlrMPM8SUZJt6 rNQef9DMcRyso5OeiipevNwUihJIqig1Lq0FvhShglZ51tNFImqtFCmtO0Zgkbhs nL1Nkrx0kWridHmDQXcE051u183jwkvFfgumopMvdqKAinoKsBAEx1QB4KOD5bcm cCiJmyiImXXWQTa/6emk =fXoA -----END PGP SIGNATURE----- --lr9mkxBmurnIWkuvbEUlWA9AET76J5ETL--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?54458B57.60106>