From owner-freebsd-security  Fri Jul  5 19:49: 6 2002
Delivered-To: freebsd-security@freebsd.org
Received: from mx1.FreeBSD.org (mx1.FreeBSD.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP
	id 5A70C37B400; Fri,  5 Jul 2002 19:49:03 -0700 (PDT)
Received: from lariat.org (lariat.org [63.229.157.2])
	by mx1.FreeBSD.org (Postfix) with ESMTP
	id 3EC1743E31; Fri,  5 Jul 2002 19:49:02 -0700 (PDT)
	(envelope-from brett@lariat.org)
Received: from mustang.lariat.org (IDENT:ppp1000.lariat.org@lariat.org [63.229.157.2])
	by lariat.org (8.9.3/8.9.3) with ESMTP id UAA29905;
	Fri, 5 Jul 2002 20:48:21 -0600 (MDT)
X-message-flag: Warning! Use of Microsoft Outlook is dangerous and makes your system susceptible to Internet worms.
Message-Id: <4.3.2.7.2.20020705204451.02607930@localhost>
X-Sender: brett@localhost
X-Mailer: QUALCOMM Windows Eudora Version 4.3.2
Date: Fri, 05 Jul 2002 20:48:15 -0600
To: thomas@cuivre.fr.eu.org, Dag-Erling Smorgrav <des@ofug.org>
From: Brett Glass <brett@lariat.org>
Subject: Re: Default ssh protocol in -STABLE [was: HEADS UP:
  FreeBSD-STABLE now has OpenSSH 3.4p1]
Cc: Mike Tancsa <mike@sentex.net>, Ruslan Ermilov <ru@FreeBSD.ORG>,
	security@FreeBSD.ORG
In-Reply-To: <20020705134934.A40046@melusine.cuivre.fr.eu.org>
References: <xzphejepfd7.fsf_-_@flood.ping.uio.no>
 <20020705073634.GA64656@sunbay.com>
 <20020705073634.GA64656@sunbay.com>
 <5.1.0.14.0.20020705073043.01c52198@192.168.0.12>
 <xzphejepfd7.fsf_-_@flood.ping.uio.no>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

At 05:49 AM 7/5/2002, Thomas Quinot wrote:

>Since the version change is going to suprise people anyway, I'd say let
>us do it all the way and switch to protocol 2,1. It is more than time
>to phase out protocol 1.

Alas, too many clients use Protocol 1 only. And Protocol 1 really isn't
that bad, security-wise! In fact, after the rash of recent bugs in
code that's exclusively used by Protocol 2 (with, I suspect, more
yet to be found), I've set quite a few servers that really only 
communicate with Protocol 1 clients to do Protocol 1 only.

I may reconsider this move in a year or so, but for now it seems
to be the safest way to go.

--Brett Glass


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message