Skip site navigation (1)Skip section navigation (2)
Date:      Sun, 24 Jun 2012 12:59:20 -0400
From:      "J. Hellenthal" <jhellenthal@dataix.net>
To:        "Bjoern A. Zeeb" <bzeeb-lists@lists.zabbadoz.net>
Cc:        freebsd-security@freebsd.org, Robert Simmons <rsimmons0@gmail.com>
Subject:   Re: Add rc.conf variables to control host key length
Message-ID:  <20120624165920.GA85913@DataIX.net>
In-Reply-To: <4828EFCC-E60A-4961-9228-4A1ADAD28F73@lists.zabbadoz.net>
References:  <CA%2BQLa9CX26xEwRsz3g6FvBBbbFE0Gfw%2BUR6_RHYOXgZFcgCw5w@mail.gmail.com> <4828EFCC-E60A-4961-9228-4A1ADAD28F73@lists.zabbadoz.net>

next in thread | previous in thread | raw e-mail | index | archive | help


On Sun, Jun 24, 2012 at 04:34:04PM +0000, Bjoern A. Zeeb wrote:
> 
> On 24. Jun 2012, at 16:07 , Robert Simmons wrote:
> 
> > Here is a set of patches that add functionality to rc.conf allowing
> > users an easy way to control the length of the host keys used with ssh
> > (specifically RSA and ECDSA used with protocol version 2).
> 
> Created for, not used with -- right?
> 
> The used with is controlled in sshd_config and if the key is not there
> but it's enabled in sshd_config you'll get a warning on boot which is
> very annoying.
> 
> 
> > I would like to also discuss the merits of changing FreeBSD's default
> > behavior to using 4096 bit RSA keys and 521 bit ECDSA keys.
> > 
> > I have refrained from changing FreeBSD's default behavior in these
> > patches and stuck to just adding configurability.
> 
> Do we differ from what the OpenSSH defaults are?
> 

Defaults being ...

2048 RSA
1024 DSA
256  ECDSA


These are more then sufficient for any normal ssh use.


-- 

 - (2^(N-1))



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20120624165920.GA85913>