From owner-freebsd-security@FreeBSD.ORG  Mon Jun  3 08:04:42 2013
Return-Path: <owner-freebsd-security@FreeBSD.ORG>
Delivered-To: freebsd-security@freebsd.org
Received: from mx1.freebsd.org (mx1.FreeBSD.org [8.8.178.115])
 by hub.freebsd.org (Postfix) with ESMTP id 5883EEDF
 for <freebsd-security@freebsd.org>; Mon,  3 Jun 2013 08:04:42 +0000 (UTC)
 (envelope-from victor@bsdes.net)
Received: from equilibrium.bsdes.net
 (244.Red-217-126-240.staticIP.rima-tde.net [217.126.240.244])
 by mx1.freebsd.org (Postfix) with ESMTP id 0A4DC1D2F
 for <freebsd-security@freebsd.org>; Mon,  3 Jun 2013 08:04:41 +0000 (UTC)
Received: by equilibrium.bsdes.net (Postfix, from userid 1001)
 id BDA3322877; Mon,  3 Jun 2013 10:04:40 +0200 (CEST)
Date: Mon, 3 Jun 2013 10:04:40 +0200
From: Victor Balada Diaz <victor@bsdes.net>
To: freebsd-security@freebsd.org
Subject: Re: OpenSSH ignores /etc/ssl/openssl.cnf
Message-ID: <20130603080440.GM74846@equilibrium.bsdes.net>
References: <20130603071608.GL74846@equilibrium.bsdes.net>
MIME-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <20130603071608.GL74846@equilibrium.bsdes.net>
User-Agent: Mutt/1.5.21 (2010-09-15)
X-BeenThere: freebsd-security@freebsd.org
X-Mailman-Version: 2.1.14
Precedence: list
List-Id: "Security issues \[members-only posting\]"
 <freebsd-security.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/options/freebsd-security>, 
 <mailto:freebsd-security-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-security>
List-Post: <mailto:freebsd-security@freebsd.org>
List-Help: <mailto:freebsd-security-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>, 
 <mailto:freebsd-security-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Mon, 03 Jun 2013 08:04:42 -0000

On Mon, Jun 03, 2013 at 09:16:08AM +0200, Victor Balada Diaz wrote:
> Hello,
> 
> While trying to configure padlock(4) engine as default engine for my system
> i've noticed that OpenSSH ignores openssl.cnf. Ie:
> 
> $ truss openssl speed aes-128-cbc 2>&1  |grep -i openssl.cnf
> open("/etc/ssl/openssl.cnf",O_RDONLY,0666)       = 3 (0x3)
> 
> $ truss scp -c aes128-cbc localhost:/tmp/foo /tmp/bar 2>&1 |grep -i openssl
> $
> 
> How should i configure it without using openssl.cnf?
> 
> FreeBSD version: 9.0 and 9.1, i386 and amd64, with base openssl and openssh.
> 
> Regards.
> Victor.

Found the problem:

https://bugzilla.mindrot.org/show_bug.cgi?id=1882

It's been fixed on HEAD and 9-STABLE. Is there any chance to get an errata update
for 9.1-RELEASE?

If not, i think it should be documented on the late breaking news of the errata
web page.

Thanks a lot.
Regards.
Victor.
-- 
La prueba más fehaciente de que existe vida inteligente en otros
planetas, es que no han intentado contactar con nosotros.