3 ms·

This doesn't seem like a particularly interesting release. A few fixes. A few defaults changed. Am I missing something?

rockdoe 11y ago
* Support for the 1024-bit diffie-hellman-group1-sha1 key exchange is disabled by default at run-time. It may be re-enabled using the instructions at http://www.openssh.com/legacy.html http://www.openssh.com/legacy.html * Support for ssh-dss, ssh-dss-cert-* host and user keys is disabled by default at run-time. These may be re-enabled using the instructions at http://www.openssh.com/legacy.html http://www.openssh.com/legacy.html
s_dev 11y ago
I understand that no piece of software is ever finished but I think OpenSSH serves its purpose very well and isn't the kind of software that is worth adding experimental features that would change its scope/purpose and therefore releases tend towards bug fixes and security patches and in this sense makes it kind of "finished" as much as I hate saying it like that. An important aspect of unix philosophy is one tool does one job very well.
- mike-cardwell 11y ago
  I agree. I'm just trying to figure out what prompted this to be posted here? I assumed there would be something particularly interesting about this release, but I can't see it...
  - s_dev 11y ago
    I suppose such a large number of people here would be absolutely dependant on OpenSSH so any kind change or update is news to them. As well the 7.0 version number makes for a lovely even number and catching headline.
    - joshbaptiste 11y ago
      Yep, major version number changes usually bring about excitement to view what's new...
theandrewbailey 11y ago
* sshd(8): fix circumvention of MaxAuthTries using keyboard- interactive authentication. By specifying a long, repeating keyboard-interactive "devices" string, an attacker could request the same authentication method be tried thousands of times in a single pass. The LoginGraceTime timeout in sshd(8) and any authentication failure delays implemented by the authentication mechanism itself were still applied. Found by Kingcope. That's a pretty big hole. See also: http://seclists.org/fulldisclosure/2015/Jul/92 http://seclists.org/fulldisclosure/2015/Jul/92
- xorcist 11y ago
  Very few systems run with this configuration, with the major exception of FreeBSD. No common Linux distribution does.
  - Elhana 11y ago
    Someone using OTP like google auth would likely be affected on linux, but it is not default and you can hardly bruteforce it either. On top of that fail2ban should deal with such bruteforce attempts just fine.
lamby 11y ago
You're probably missing that SSH just increments the version number. Ticking over to a new whole number is meaningless from their point of view IIRC.

* Support for the 1024-bit diffie-hellman-group1-sha1 key exchange is disabled by default at run-time. It may be re-enabled using the instructions at http://www.openssh.com/legacy.html http://www.openssh.com/legacy.html * Support for ssh-dss, ssh-dss-cert-* host and user keys is disabled by default at run-time. These may be re-enabled using the instructions at http://www.openssh.com/legacy.html http://www.openssh.com/legacy.html

s_dev 11y ago

I understand that no piece of software is ever finished but I think OpenSSH serves its purpose very well and isn't the kind of software that is worth adding experimental features that would change its scope/purpose and therefore releases tend towards bug fixes and security patches and in this sense makes it kind of "finished" as much as I hate saying it like that. An important aspect of unix philosophy is one tool does one job very well.

mike-cardwell 11y ago
I agree. I'm just trying to figure out what prompted this to be posted here? I assumed there would be something particularly interesting about this release, but I can't see it...
- s_dev 11y ago
  I suppose such a large number of people here would be absolutely dependant on OpenSSH so any kind change or update is news to them. As well the 7.0 version number makes for a lovely even number and catching headline.
  - joshbaptiste 11y ago
    Yep, major version number changes usually bring about excitement to view what's new...

theandrewbailey 11y ago

* sshd(8): fix circumvention of MaxAuthTries using keyboard- interactive authentication. By specifying a long, repeating keyboard-interactive "devices" string, an attacker could request the same authentication method be tried thousands of times in a single pass. The LoginGraceTime timeout in sshd(8) and any authentication failure delays implemented by the authentication mechanism itself were still applied. Found by Kingcope. That's a pretty big hole. See also: http://seclists.org/fulldisclosure/2015/Jul/92 http://seclists.org/fulldisclosure/2015/Jul/92

xorcist 11y ago
Very few systems run with this configuration, with the major exception of FreeBSD. No common Linux distribution does.
- Elhana 11y ago
  Someone using OTP like google auth would likely be affected on linux, but it is not default and you can hardly bruteforce it either. On top of that fail2ban should deal with such bruteforce attempts just fine.

lamby 11y ago

You're probably missing that SSH just increments the version number. Ticking over to a new whole number is meaningless from their point of view IIRC.