Date: Tue, 1 Dec 2009 03:55:18 -0800 From: Jeremy Chadwick <freebsd@jdc.parodius.com> To: Pete French <petefrench@ticketswitch.com> Cc: freebsd-stable@freebsd.org Subject: Re: SSH oddness with 8.0-STABLE Message-ID: <20091201115518.GA27115@icarus.home.lan> In-Reply-To: <E1NFR8d-000HH2-GJ@dilbert.ticketswitch.com> References: <20091201113547.GA26501@icarus.home.lan> <E1NFR8d-000HH2-GJ@dilbert.ticketswitch.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On Tue, Dec 01, 2009 at 11:43:23AM +0000, Pete French wrote: > > Usually the error you're seeing is indication that either the client or > > server changed from DSA to RSA, or vice-versa. I don't see anything in > > /etc/ssh/ssh_config or /etc/ssh/sshd_config between 7.2-STABLE and > > 8.0-STABLE which would indicate this changed. > > There is, however, a not on /usr/src/UPDATING about this precise > effect. Viz: > > 20080801: > OpenSSH has been upgraded to 5.1p1. > > For many years, FreeBSD's version of OpenSSH preferred DSA > over RSA for host and user authentication keys. With this > upgrade, we've switched to the vendor's default of RSA over > DSA. This may cause upgraded clients to warn about unknown > host keys even for previously known hosts. Users should > follow the usual procedure for verifying host keys before > accepting the RSA key. > > This can be circumvented by setting the "HostKeyAlgorithms" > option to "ssh-dss,ssh-rsa" in ~/.ssh/config or on the ssh > command line. > > Please note that the sequence of keys offered for > authentication has been changed as well. You may want to > specify IdentityFile in a different order to revert this > behavior. This would indicate the OP was running a 7.2-STABLE system which was built prior to 2008/08/01 (with some variance; sometimes the commit times do not match the timestamp in src/UPDATING), or a system which had not had mergemaster run on it to populate the changes into /etc/ssh. -- | Jeremy Chadwick jdc@parodius.com | | Parodius Networking http://www.parodius.com/ | | UNIX Systems Administrator Mountain View, CA, USA | | Making life hard for others since 1977. PGP: 4BD6C0CB |
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20091201115518.GA27115>