From owner-svn-src-head@freebsd.org  Sun Aug  7 17:37:38 2016
Return-Path: <owner-svn-src-head@freebsd.org>
Delivered-To: svn-src-head@mailman.ysv.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
 [IPv6:2001:1900:2254:206a::19:1])
 by mailman.ysv.freebsd.org (Postfix) with ESMTP id D2204BB1AF2;
 Sun,  7 Aug 2016 17:37:38 +0000 (UTC) (envelope-from slw@zxy.spb.ru)
Received: from zxy.spb.ru (zxy.spb.ru [195.70.199.98])
 (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
 (Client did not present a certificate)
 by mx1.freebsd.org (Postfix) with ESMTPS id 921AF11F0;
 Sun,  7 Aug 2016 17:37:38 +0000 (UTC) (envelope-from slw@zxy.spb.ru)
Received: from slw by zxy.spb.ru with local (Exim 4.86 (FreeBSD))
 (envelope-from <slw@zxy.spb.ru>)
 id 1bWS10-000P1N-Vf; Sun, 07 Aug 2016 20:37:34 +0300
Date: Sun, 7 Aug 2016 20:37:34 +0300
From: Slawa Olhovchenkov <slw@zxy.spb.ru>
To: Andrey Chernov <ache@freebsd.org>
Cc: Bruce Simpson <bms@fastmail.net>, Warner Losh <wlosh@bsdimp.com>,
 src-committers@freebsd.org, svn-src-all@freebsd.org,
 Oliver Pinter <oliver.pinter@hardenedbsd.org>, svn-src-head@freebsd.org,
 Dag-Erling =?utf-8?B?U23DuHJncmF2?= <des@freebsd.org>
Subject: Re: svn commit: r303716 - head/crypto/openssh
Message-ID: <20160807173734.GD22212@zxy.spb.ru>
References: <9a01870a-d99d-13a2-54bd-01d32616263c@fastmail.net>
 <CAPQ4fftQ30_aqU8V_ea-WEKBdMZs5H9Rwxnfa0crid_df049nQ@mail.gmail.com>
 <b99c06ac-82d6-ccda-419c-2ece5be4636f@fastmail.net>
 <30e655d1-1df7-5e2a-fccb-269e3cea4684@freebsd.org>
 <20160807125227.GC22212@zxy.spb.ru>
 <7237f5e6-fd65-a7e5-7751-4ed1c464b39a@freebsd.org>
 <4D28752C-0584-4294-9250-FA88B0C6E805@bsdimp.com>
 <c54673d0-8edd-b185-c86e-95a6aa6d0846@fastmail.net>
 <32b82f9f-7f78-6358-030a-90aed54bb8a8@freebsd.org>
 <0740b662-4a36-f834-229a-d16a5a6dde14@freebsd.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <0740b662-4a36-f834-229a-d16a5a6dde14@freebsd.org>
User-Agent: Mutt/1.5.24 (2015-08-30)
X-SA-Exim-Connect-IP: <locally generated>
X-SA-Exim-Mail-From: slw@zxy.spb.ru
X-SA-Exim-Scanned: No (on zxy.spb.ru); SAEximRunCond expanded to false
X-BeenThere: svn-src-head@freebsd.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: SVN commit messages for the src tree for head/-current
 <svn-src-head.freebsd.org>
List-Unsubscribe: <https://lists.freebsd.org/mailman/options/svn-src-head>,
 <mailto:svn-src-head-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/svn-src-head/>
List-Post: <mailto:svn-src-head@freebsd.org>
List-Help: <mailto:svn-src-head-request@freebsd.org?subject=help>
List-Subscribe: <https://lists.freebsd.org/mailman/listinfo/svn-src-head>,
 <mailto:svn-src-head-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Sun, 07 Aug 2016 17:37:38 -0000

On Sun, Aug 07, 2016 at 08:34:55PM +0300, Andrey Chernov wrote:

> On 07.08.2016 20:31, Andrey Chernov wrote:
> > On 07.08.2016 19:14, Bruce Simpson wrote:
> >> On 07/08/16 15:40, Warner Losh wrote:
> >>> That’s a cop-out answer. We, as a project, need to articulate to our
> >>> users, whom we care about, why this rather obnoxious hit to usability
> >>> was taken. The answer must be more complete than “We just disabled
> >>> it because upstream disabled it for reasons we’re too lazy to explain
> >>> or document how to work around"
> >>
> >> Alcatel-Lucent OmniSwitch 6800 login broken (pfSense 2.3.2 which
> >> accepted the upstream change, workaround no-go)
> >>
> >> [2.3.2-RELEASE][root@gw.lab]/root: ssh -l admin
> >> -oKexAlgorithms=+diffie-hellman-group1-sha1 192.168.1.XXX
> >> Fssh_ssh_dispatch_run_fatal: Connection to 192.168.1.XXX port 22: DH GEX
> >> group out of range
> >>
> > 
> > DH prime size must be at least 2048, openssh now refuse lower values.
> > Commonly used DH size 1024 can be easily broken. See https://weakdh.org
> > 
> diffie-hellman-group1-sha1 use DH 1024 and insecure sha1 both.

IMHO, this is wrong choise: totaly lost of control now vs teoretical
compromise of control in the future.