Date: Fri, 2 Dec 2011 15:39:30 -0800 From: Jeremy Chadwick <freebsd@jdc.parodius.com> To: Freddie Cash <fjwcash@gmail.com> Cc: stable@freebsd.org Subject: Re: r228152: anyone got the None cipher working with base OpenSSH? Message-ID: <20111202233930.GA43590@icarus.home.lan> In-Reply-To: <20111202233220.GA43495@icarus.home.lan> References: <CAOjFWZ4W1=TbLuMhi17shuYaNbGq18N1DWYLXiyiJ72gOM_6qA@mail.gmail.com> <20111202233220.GA43495@icarus.home.lan>
next in thread | previous in thread | raw e-mail | index | archive | help
On Fri, Dec 02, 2011 at 03:32:20PM -0800, Jeremy Chadwick wrote: > There are multiple places where this needs to get defined for it to > work. Sorry I should be more clear (I woke up ~15 minutes ago). I'm referring to the fact that OpenSSH build points in FreeBSD are ""scattered all over"", e.g. src/secure/lib/libssh, src/secure/usr.bin/scp, src/secure/usr.bin/sftp, src/secure/usr.bin/ssh*, etc... You get the idea. The above make.conf addition will handle everything. And yes I have tested it. You also need to read README.hpn to understand fully how to get None cipher to work from the server AND client side, *AND* what the limits and caveats are. There are changes you need to make to /etc/ssh/sshd_config, and there are *multiple* -o switches you will need to use with the client (e.g. ssh -oCipher=none -oNoneEnabled=yes -oNoneSwitch=yes). If the WARNING message that is output to stderr bothers you, use -T. Good luck. -- | Jeremy Chadwick jdc at parodius.com | | Parodius Networking http://www.parodius.com/ | | UNIX Systems Administrator Mountain View, CA, US | | Making life hard for others since 1977. PGP 4BD6C0CB |
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20111202233930.GA43590>