Date: Mon, 20 Oct 2014 18:23:19 -0400 From: Allan Jude <allanjude@freebsd.org> To: freebsd-current@freebsd.org Subject: Re: ssh None cipher Message-ID: <54458B57.60106@freebsd.org> In-Reply-To: <20141020183340.GC94319@spindle.one-eyed-alien.net> References: <CAOc73CCvQqwg65tt9vs54CoU1HGvV7ZxLWeQwXiSOm8UjtV50w@mail.gmail.com> <alpine.GSO.1.10.1410172242240.27826@multics.mit.edu> <5441E834.2000906@freebsd.org> <20141020183340.GC94319@spindle.one-eyed-alien.net>
index | next in thread | previous in thread | raw e-mail
[-- Attachment #1 --] On 2014-10-20 14:33, Brooks Davis wrote: > On Sat, Oct 18, 2014 at 12:10:28AM -0400, Allan Jude wrote: >> On 2014-10-17 22:43, Benjamin Kaduk wrote: >>> On Fri, 17 Oct 2014, Ben Woods wrote: >>> >>>> Whilst trying to replicate data from my FreeNAS to my FreeBSD home theater >>>> PC on my local LAN, I came across this bug preventing use of the None >>>> cipher: >>>> https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=163127 >>>> >>>> I think I could enable the None cipher by recompiling base with a flag in >>>> /etc/src.conf. >>> >>> I agree. >>> >>>> Is there any harm in enabling this by default, but having the None cipher >>>> remain disabled in /etc/ssh/sshd_config? That way people wouldn't have it >>>> on my default, but wouldn't have to recompile to enable it. >>> >>> I do not see any immediate and concrete harm that doing so would cause, >>> yet that is insufficient for me to think that doing so would be a good >>> idea. >> >> I've been using openssh-portable from ports with the none cipher patch >> to get around this. >> >> IIRC, upstream openssh refuses to merge the none cipher patches "because >> you shouldn't do that". But I'd vote for having it compiled in and just >> disabled by default. >> >> It will refuse to let you have a shell without encryption, and prints a >> big fat hairy warning when encryption is disabled. > > When Bjoern and I did the merge of the HPN patches we left None disable > by default out of a desire to be conservative with a change we knew some > people didn't like. I think turning it on by default would be fine given > the seatbelts in place to prevent accidental inappropriate use. > > -- Brooks > +1 to this. -- Allan Jude [-- Attachment #2 --] -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (MingW32) iQIcBAEBAgAGBQJURYtXAAoJEJrBFpNRJZKffG4QAIRhTMFT8f/5nXUL99DGW5Ag 722nBVgof6rALvsePoNo998QTOJ1Wj3dgOJWH8HPg0NcdfNJLHX3hYTUPlLURSKn G+Zjo23WRtjbEIMOE2rrFYRs3R0WTwQcIMQQyt+Xgix+MsPrboUefMQ1M7P7Q880 wTUVLLNKxoZFvszf/if9JDWBpGaskwgvx6ogbdcmq7gAVaR6Xqq3bDHLLb/dWNvm UkKvWbkzLtXVbkGhT6Q1iIvblTDyAZeUqLYiPgMw00ce1KlBW4USPi7tkGJbKav2 LLL3NK7s+L+TBaB5um9pw0t2K0Pyro1a3aLVQskx6JynCQX3R0eJ1GHSCM2weOKi BBpxGO77ZE8q1KAwWzvNF3itbQjy18X7MuysdDTioNBkp6nB1zp809BXL4yHassc bVBTrfOKM/nMcyLPbbDxfGoBRXWASjTZnlKnkB/Di+GUghQdW/4mjUBzWapbPdQu yl1yvrJbjAE3ZsYMjNGssPJYV+ERWHZeIpAXMGvAsszTlFYimgNNlrMPM8SUZJt6 rNQef9DMcRyso5OeiipevNwUihJIqig1Lq0FvhShglZ51tNFImqtFCmtO0Zgkbhs nL1Nkrx0kWridHmDQXcE051u183jwkvFfgumopMvdqKAinoKsBAEx1QB4KOD5bcm cCiJmyiImXXWQTa/6emk =fXoA -----END PGP SIGNATURE-----help
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?54458B57.60106>